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Abstract 
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1 Introduction 



Let a denote an axiom system, and d denote a deduction method. The ordered pair 
(a, d) will be called Self Justifying when: 

i one of a 's theorems states that the deduction method d, applied to the system a, 

will produce a consistent set of theorems, and 

ii the axiom system a is in fact consistent. 

For any (a, d) , it is easy to construct a second axiom system a'^ D a that satisfies 
Part-i of this definition. For instance, a'^ could consist of all of a 's axioms plus the 
following added sentence, that we call SelfRef(Q;, d) : 

• There is no proof (using d's deduction method) of = 1 from the union 
of the axiom system a with this sentence "SelfRef(a, d) " (looking at itself). 

Kleene [19] discussed how to encode approximate analogs of SelfRef(a, (i)'s self-referential 
statement. Each of Kleene, Rogers and Jeroslow [19, 35, 17] noted a*^ may, however, be 
inconsistent (despite SelfRef(Q;, (i)'s assertion), thus causing it to violate Part-ii of self- 
justification's definition. 

This problem arises in settings more general than Godel's paradigm, where a was 
an extension of Peano Arithmetic. There are many settings where the Second Incom- 
pleteness Theorem does generalize [1, 2, 3, 8, 9, 10, 11, 14, 15, 16, 21, 24, 25, 29, 30, 32, 
33, 34, 35, 37, 39, 44, 46, 49, 52, 54, 56, 58, 62, 66, 63, 67]. Each such result formalizes 
a paradigm where self-justification is infeasible, due to a diagonalization issue. Most 
logicians have hesitated to thus employ a SelfRef(a, d) axiom because a-|-SelfRef(Q;, d) is 
usually inconsistent ^. 

Our research explored special circumstances [61, 64, 65, 66] where it is feasible to 
construct self-justifying formalisms. These paradigms involved weakening the properties 
a system can prove about addition and/or multiplication (to avoid the preceding difficul- 
ties). To be more precise, let Add{x,y, z) and Mult{x,y, z) denote two 3-way predicates 

^ Typical ordered pairs (q, d) will have the property that the broader axiom system 
a"* = a + SelfRef(a, d) will be inconsistent, even when a is consistent. This is because a standard 
Godel-like self-referencing construction will typically produce a proof of = 1 from a'' , irregardless of 
whether or not a is consistent. 
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indicating x, y and z satisfy x + y = z and x * y = z. A logic will be said to recognize 
successor, addition and multiplication as Total Functions iff it includes 1-3 as axioms. 



Vx 3z Add{x, 1, z) 
\/x\/y3z Add{x,y,z) 
\/x My 3z Mult{x, y, z) 



(1) 
(2) 
(3) 



We will say a logic system a is Type-M iff it contains each of (1) - (3) as axioms, 
Type-A iff it contains only (1) and (2) as axioms, and Type-S iff it contains only (1) 
as an axiom. A system is called Type-NS iff it does not contain any of these axioms. 

Our investigations [61]-[67] began by observing some Type-A systems can recognize 
their consistency under semantic tableaux deduction, and several Type-NS systems can 
recognize their Hilbert consistency. Many of these systems were capable of proving Peano 
Arithmetic's Hi theorems in a language that represents addition and multiplication as 
the 3-way predicates of Add{x,y, z) and Mult{x, y,z). 

Our self-justifying evasions of the Incompleteness Theorem are difficult to further 
extend primarily because the combined work of Pudlak, Solovay, Nelson and Wilkie- 
Paris [26, 33, 44, 58] showed natural Type-S systems cannot recognize their own Hilbert 
consistency. Also, Willard [62, 67, 68] strengthened earlier results of Adamowicz-Zbierski 
[1, 3] to establish that natural Type-M system cannot recognize their semantic tableaux 
consistency. 

A related class of evasions of the Second Incompleteness Theorem was discovered in 
[68]. Let us say a is a Type-Almost-M axiom system iff a can prove statements 
(4) and (5) as theorems while treating none of sentences (1) - (5) as axioms. (Many 
axiom systems, that use function symbols " + " and " * " for formalizing addition and 
multiplication, fall technically into the Type-Almost-M category.) 



The preceding is of interest because some surprisingly strong (albeit unusual) Type- 
Almost-M systems [68] have an ability to verify their Herbrand but not also semantic 
tableaux consistency. 

The proofs in our prior papers were challenging primarily because they required one 
to separate the local combinatorial methods employed in [59, 64, 66, 68] 's particular 
applications from the common principles that underlied behind all these works. Our 
Theorems 5.9, 5.11 and 6.6 will rectify this problem by identifying common components 
that unite these four paradigms. (Theorems 6.3, 6.10, 6.12, E.l, G.2 and G.3 will then 
carry on in further directions.) 



Mx My 3z X + y = z 



(4) 



MxMy 3z X * y = z 



(5) 
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All these theorems will contain severe limits on their generality, so that the Second 
Incompleteness Theorem does not contradict them. It is clearly perplexing to imagine 
how humans are able to motivate themselves to cogitate, without their thought processes 
possessing some type of at least tentative presumption of their own consistency. Our 
research has thus consisted of an approximately equal effort in exploring both [62, 63, 
66, 67] 's new generalizations of the Second Incompleteness Theorem and [59, 61, 64, 65, 
66, 68] 's unusual boundary-case exceptions to it. 

It is clear every boundary-case exception to the Second Incompleteness Theorem has 
limited scope because the Incompleteness Theorem is a broadly encompassing result. 
This paper will, thus, be addressing a challenging near-paradoxical question about the 
maximal nature of self-justification that can never be resolved in a fully satisfying man- 
ner. The Second Incompleteness Theorem is clearly sufficiently central to logic for it 
to be desirable to know what partial roads of success a self-justifying axiom system can 
obtain. 

2 Literature Survey 

Two 5-page surveys of the prior literature about the Second Incompleteness Theorem 
were provided in our articles [64, 66] . This section will present a more abbreviated survey, 
focusing on only those developments that are particularly germane to the current article. 

The study of incompleteness began with four classic papers by Godel, Lob, Rosser 
and Tarski [14, 25, 36, 50] and with the Hilbert-Bernays exploration of their derivability 
conditions [15, 16, 18]. Generalizations of these results for weak axiom systems, such as 
Q, began with the work of Tarski-Mostowski-Robinson [51] and Bezboruah-Shepherdson 
[8]. 

Some more notation is needed to describe more recent developments. Let x' denote 
the "successor" operation that maps x onto x + 1. A formula (p{x) is called [15] a 
Definable Cut for an axiom system o; iff a can prove: 

ip{0) AND V X { ip{x) ^ip{x' )} AND \/ x\/y<x { ip{x) ip{y) } (6) 

Definable cuts and their cousins have been studied by an extensive literature [1, 3, 6, 9, 
10, 15, 18, 21, 22, 26, 27, 29, 30, 31, 32, 33, 34, 39, 45, 46, 52, 54, 55, 56, 57, 58]. (They 
are unrelated to Gentzen's notion of sequent calculus deductive "cut rule", which uses 
the word "cut" in a different context). 

A Definable Cut fix) is called Non- Trivial relative to an axiom system a iff 
a cannot prove V x (p{x) , although it can prove (6). Every axiom system a, strictly 
weaker than Peano Arithmetic, will contain some non-trivial Definable Cut. This cut 
will have the property that a can verify (/?(n) for each fixed integer n, although it 
cannot prove V x f{x) . 
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Let \^~\ denote ^'s Godel number, and Prf^ {t^p) denote that p is a proof of the 
theorem t from the axiom system a using d's deduction method. An axiom system 
a win then be said to recognize its own Cut-Localized d- Consistency relative to a 
Definable Cut <y9 iff a can prove: 

yp { ipip) -Prf^ ( [0 = 11 , p) } (7) 

The recent literature has sought to identify which triples d, a) have this property. 
A crucial negative result about Cut-Localized d-Consistency, discovered by Pudlak [33], 
established a significant generalization of Godel's Second Incompleteness Theorem. It 
showed that an axiom system a must be unable to prove (7) 's statement about any of its 
definable cuts cp , when d represents Hilbert deduction and a is any consistent extension 
of Q. 

Solovay [44] noted how Pudlak's result could be combined with the techniques of 
Nelson and Wilkie-Paris [26, 58] to establish the following theorem that will often be 
cited in this paper: 

Theorem 2.1 (Solovay's 1994 Generalization [44] of a 1985 theorem of Pudlak 
[33] using some of Nelson and Wilkie-Paris [26, 58] 's methods ) : Let a denote 
any axiom system which contains Equation (l)'s Type-S statement and which as- 
sures the successor operation always satisfies x' 7^ and x' = y' <^ x = y. Then 
a will be unable to recognize its own Hilbert consistency, whenever it treats addi- 
tion and multiplication as 3-way relations satisfying their usual identity, associative, 
commutative and distributive properties. 

Solovay never published any precise proof of Theorem 2.1's hybridizing of the work of 
Pudlak, Nelson and Wilkie-Paris [33, 26, 58], which he privately communicated [44] to 
us. A reader can find generalizations of the Second Incompleteness Theorem that are 
closely related to Theorem 2.1 in papers by Pudlak, Buss-Ignjatovic, Svejdar and Willard 
[10, 33, 46, 63], as well as in Appendix A of [61]. 

Other interesting observations that preceded our research were that Wilkie-Paris [58] 
demonstrated that ISq + Exp cannot prove the Hilbert consistency of even the axiom 
system Q, and that Adamowicz-Zbierski [1, 3] showed that IEq -|- f^i satisfied the 
Herbrandized version of the Second Incompleteness Theorem. Both these results helped 
stimulate [62, 67] 's semantic tableaux generalizations of the Second Incompleteness The- 
orem for ISq. 

A fascinating observation by L. A. Kolodziejczyk [20, 21], about the difference in 
lengths between semantic tableaux and Herbrandized proofs, also motivated our investi- 
gation [68] into some surprising properties of unorthodox encodings for ISq. Kolodziejczyk 
observed [20, 21] that various generalizations of the Second Incompleteness Theorem for 
ISq and ISq -I- in [1, 3, 37, 62, 67, 68] imply that the proof of the Herbrandized ver- 
sion of the Second Incompleteness Theorem can be more complicated than its semantic 
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tableaux counterpart. This is because there can be an exponential difference between 
semantic tableaux and Herbrandized proof lengths under extremal circumstances. It was 
due to Kolodziejczyk's insightful communications ^ that [68] developed an axiom sys- 
tem that was a boundary-case exception to the Herbrandized but not also the semantic 
tableaux version of the Second Incompleteness Theorem. 

The literature on Definable Cuts has centered its evasions of the Second Incom- 
pleteness Theorem around Equation (7)'s localization formalism (rather than employing 
analogs of Section I's SelfRef(Q;, axiom, as we did in [59, 61, 64, 65, 66, 68]). Pudlak 
[33] proved that essentially every axiom system a of finite cardinality can be associated 
with a definable cut such that a can prove sentence (7)'s validity for (p when d 
is either the semantic tableaux or Herbrand-styled deductive method. 

Pudlak's theorem is related to Friedman's observation [13] that for many finite the- 
ories S and T, the theory S has an interpretation in T if and only if ISq + Exp can 
prove that T's Herbrand consistency implies S"s Herbrand consistency. Several general- 
izations of these results by Kraji'cek, Pudlak, Smoryhski, Svejdar and Visser appear in 
[22, 33, 34, 39, 46, 54, 55, 56]. Visser's article [56] contains an excellent review of this 
literature, as well as many additional new results. Also, wc will sec how some of the reflec- 
tion machines of Beklemishev, Kreisel-Takeuti and Verbrugge- Visser [5, 6, 7, 24, 52, 56] 
nicely complement Theorem 6.12's reflection mechanisms in alternate types of intended 
applications. 

It was established by Hajek, Svejdar and Vopenka [45, 57] that GB Set Theory can 
construct a definable cut tp where it can prove the statement (7) is valid when d denotes 
Hilbert deduction and a is ZF Set Theory. This result was surprising because Pudlak 
[33] showed GB can never verify its own Hilbert consistency localized on a definable cut. 
(Thus, GB will view its Hilbert consistency as equivalent to ZF's Hilbert consistency in 
a global sense but not in a cut-localized respect.). 

In some sense, Kreisel and Takeuti [24, 47] can be viewed as the first authors to 
develop a logic recognizing its own consistency using a variant of Equation (6)'s formula. 
Their results for typed logics formalized a second-order generalization of Gentzen's se- 
quent calculus that can verify its own consistency, when no sequent calculus deductive 
cuts are performed. A key aspect of their formalism can be seen as using an analog of 
(7)'s sentence in an implicit manner. It thus begins by using a set of objects, which we 
shall call /, that includes all the standard integers plus some allowed non-standard 

^ The Herbrandized and semantic tableaux definitions of an axiom system a's consistency are different 

from each other because the former requires skolemizing a 's axioms, while the latter permits [12] an 
existential quantifier elimination rule to replace Skolemization. This distinction can create a potential 
exponential difference between the lengths of Herbrand and Semantic Tableaux proofs. This insightful 
observation, due to private communications from L. A. Kolodziejczyk [20], was used in [68] to create 
an axiom system that satisfied the semantic tableaux but not also Herbrandized version of the Second 
Incompleteness Theorem. 
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integers (that can permissibly represent contradictory proofs). Their second-order logic 
then uses Dedekind's definition of the natural numbers to construct a subset of / , 
called " " , which includes all the standard integers and which is disallowed to contain 
any contradiction proof. We will not go into the details here, but this transition from / 
to N (with an accompanying relativization of the provability predicate onto N 's more 
restricted domain) can be viewed as Kreisel-Takeuti's analog of (7)'s local consistency 
statement for [24, 47] 's "CFA" second-order logic. 

It is difficult to compare our research (which has relied upon an analog of SelfRef(a, (i)'s 
Kleene-like "/ am consistent" axiom) with the preceding literature that has used various 
forms of Localized d- Consistency statements. This is because every effort to evade the 
Second Incompleteness Theorem employs some built-in weakness to evade Godel's classic 
paradigm. 

Our work in [59, 61, 64, 65, 68] represented less than a full-scale evasion of the 
Second Incompleteness Theorem mostly because it was incompatible with treating as 
formal axioms the statements in Equations (3) and (5) that multiplication is a total 
function ^ . Some reasons why it was helpful for [59, 61, 64, 65, 68] to employ analogs 
of Section I's SelfRef axiom are that: 

A An axiom's self-referential "/ am consistent" declaration allows a formalism to recog- 
nize its consistency in a global sense, rather than in the (^—localized sense used by 
sentence (7) and the analogous Kreisel-Takeuti relativization of their second-order 
proof predicate. 

B If a logic is employing a deductive method d that lacks a modus ponens rule, as 
occurs in nearly all self-justifying systems, then it is preferable for it to view its "/ 
am consistent" statement as an axiom rather than as a theorem. (This is because 
weak deductive methods are capable of drawing logical inferences only from axioms 
when modus ponens is absent.) 

C Analogs of Section I's SelfRef (a, d)'s "/ am consistent" axiom have been shown by 
[59, 61, 64, 65, 66, 68] to at least partially formalize the notion of a logic possessing 
an almost instinctive form of faith in its own internal consistency. (This paper will 
make it apparent that such an instinctive faith is less than a full-scale proof. Yet, 
Theorem 6.12 and Remarks 6.13, 6.14 and 6.16 will make it apparent that such 
formalizations of instinctive faith are also useful.) 

^This caveat applies also to our article [68], although its Herbandized form of self-justification differs 
from our other papers by retaining a capacity to treat (5)'s statement about multiplication's totality as 
a derived theorem that is not an axiom. The key point is that theorems are weaker than axioms under 
Hcrbrand deduction because only axioms arc used as intermediate steps during proofs. This explains 
intuitively how [68] 's formalism was able to recognize its Herbrandized consistency, while treating (5)'s 
statement about the totality of multiplication as a theorem. (We will return to this subject in Appendix 
D.) 
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We emphasize that both virtues and drawbacks of SelfRef(a, (i)'s "/ am consistent" axiom 
statements have been cited in this paragraph because every effort to evade the Second 
Incompleteness Theorem can obtain no more than hmited levels of success. 

The scope of the challenge we face becomes apparent when one realizes a + SelfRef(a, d) 
is inconsistent for most {a,d). This is because a+SelfRef(a, d) typically satisfies Part- 
i but not also Part-ii of Section I's definition of a "self-justifying" logic. (Thus, a 
diagonalization paradigm will typically imply a + SelfRef(a, d) is inconsistent, as a con- 
sequence of it containing SclfRcf(a,d) as an axiom.) This is the reason Kleene, Rogers 
and Jeroslow [19, 35, 17] were hesitant about the utility of SelfRef(a, (i)'s mirror-like 
axiom sentence. Our goal in [59]- [68] has been to develop generalizations and boundary- 
case exceptions for the Second Incompleteness Theorem, so as determine exactly which 
paradigms can support, for example. Theorem 6.12's limited notion of self-justification. 

The reason one would anticipate some limited exceptions to the Second Incomplete- 
ness Theorem to exist is it is hard to imagine how humans can motivate themselves to 
cogitate without using some variant of self-justification. 

3 Generic Configurations 

The phrase Bounded Quantifier will refer to expressions of the form "3 v < T" 
or "V v < T" where T is a term. A formula is called Fully-Bounded when all its 
quantifiers are so bounded. Lemma 3.6 will soon explain how Definition 3. I's formalism 
can encode conventional arithmetic: 

Definition 3.1 Let ^ denote some non-integer indexing superscript (whose prop- 
erties will be discussed later by Definition 3.4). Then the symbol Aq will denote some 
fixed special set of fully-bounded formulae that is closed under negation, in a language 
that will be later called . (Thus, if some formula is a member of Aq then so 
is -1 * .) Items 1-3 formalize how 11^ and E| formulae are built in a straightforward 
manner out of these Aq sub-components: 

1. Every Aq formula is considered to be also a IIq and Eq formula. 

2. For n > 1 , a formula will be called n| iff it can be written in the canonical 
form of Vf 1 Vf2 ... ViJ^ ^{vi,V2, --Vk ), where $ is ^^-i- 

3. Likewise for n > 1 , a formula will be called S| iff it can be written in the 
form of 3^1 3t!2 ... ^{vi,V2, ■■Vk), where $ is n^_i. 

Notation Convention: Our rules for defining ^, specified later in this section, will 
never have this superscript designate an integer quantity. This is because integer super- 
scripts have a special meaning under a typed-based hierarchy, not intended here. 
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Example 3.2 Let L denote a conventional arithmetic language that uses function 
symbols for denoting addition and multiplication. Below are two examples of Aq— like 
formulae that invoke Definition 3.1's notation: 

a The symbol " " will denote any fully bounded formula that uses the addition, 
multiplication and maximum function symbols in an arbitrary manner. (Thus, A^ 
corresponds to what many textbooks [15, 18, 23] simply call a " Aq " formula.) 

b The symbol " Aq " will denote a class of formulae in L's language whose bounded 
quantifiers are allowed to use only the Maximum function symbol. Their bodies, 
however, may contain any combination of addition, multiplication and maximum 
function symbols. 

Formulae (8) and (9) illustrate the distinction between the Aq^ and Aq^ classes. Thus, 
(8) satisfies the first but not second condition (on account of the presence of the mul- 
tiplication symbol used by its bounded quantifiers). In contrast, (9) is an example of a 
Aq^ formula. 

3y<x*x yz<y*y 3w<y*z : { x*y = z + w } (8) 

3y<x yz<y 3 w < MsLK{y , z) : { x*y = z + w } (9) 

The distinction between A^ arithmetic formulae and the unconventional Aq class may 
first convey the impression that these two classes have fundamentally different natures. 
Actually, Lemma 3.6 will show that their relationship is more subtle. This is because 
its formalism will map A^ formulae onto Aq^ expressions that are equivalent to it under 
Definition 3.3's Standard-M model — in a context where only the length of these 
formulae is allowed to possibly grow. This equivalence enabled [68] to construct a natural 
axiomatic formalism that could recognize its own Herbrandized consistency but which 
nevertheless satisfied the idealized form ^ of the semantic tableaux version of the Second 
Incompleteness Theorem. 

Definition 3.3 "Standard-M" will denote the standard model of integers. 

The reason for our interest in Standard-M is that many pairs of formulae are equiva- 
lent under the Standard-M model, while weak axiom systems often cannot formally prove 
they are equivalent. For instance, this will occur when Example 3.5 examines Definition 
3.4's properties. 



''An axiom system a is defined to satisfy the "idealized form" of the semantic tableaux version 

Second Incompleteness Theorem when no /3 3 a can prove a semantic tableaux proof of 0=1 from itself 
is incapable of existing. We will summarize [68] 's formalism and the distinction between Herbrandized 
and semantic tableaux deduction at the of Appendix D. 
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Definition 3.4 A Generic Configuration, often identified by the superscript sym- 
bol of ^ , is defined to be a 5-tuple ( , Aq , , d, G) where: 

1. is a language that includes logical symbols for "0", "1", "2", "=", "<" and for 
the operation of "Maximum(x,y)" . also includes a sufficient number of function 
and constant symbols so that every integer k can be encoded by some term 
specifying k 's value. 

2. Aq corresponds to any variation of Definition S.l's class of "fully-bounded" for- 
mulae that is rich enough to assure that there exists two Aq formulae, henceforth 
called "Add(x,y, z)" and "Mult(x, y, z)", for formalizing the graphs of addition 
and multiplication. (It will generate ^'s set of n| and sentences, using Defini- 
tion S.l's 3-part formalism.) 

3. B^ denotes a "Base Axiom System", whose axiom-sentences are true under 
the Standard-M model and which is complete. (Thus, B^ can prove every true 
sf sentence, and it can likewise refute all false nf sentences.) 

4. d denotes ^ 's method of deduction. It is required to be sufficiently conven- 
tional to satisfy the usual indirect-implication property ^ associated with Godel's 
Completeness Theorem. 

5. g denotes a method for encoding the Godel numbers of proofs. 

Example 3.5 Let us recall Example 3.2 defined " A^^ " as essentially the conven- 
tional textbook notion [15, 23] of an arithmetic " Aq " formula. This example will outline 
how well-known techniques can map every A^^ formula onto a semantically equivalent 
Aq formula under the Standard-M model. 

Our discussion will have Seq(a;) denote a function that maps non-negative integers 
onto binary strings in lexicographic order. Thus Seq(x) maps onto the empty string, 
the integers 1 and 2 onto the strings of "0" and "1", the integers 3-6 onto "00", "01", 
"10", "11", etc. (Formally, Seq(ar) is an operation that maps integer x onto the bit- 
string that occurs to the immediate right of the leftmost "1" bit in the binary encoding 
of x + 1. ) 

Given any A;— tuple { xi , X2 , ■■■ Xk ), let STRING(xi, X2, ---Xk) denote the con- 
catenation of Seq(xi), ... Seq(a;fe). For any integers v and w satisfying v < w"^, it is clear 
that there exists {xi,X2,X3) where STRING (xi, X2, X3) represents u's binary encoding 
and each Xi < Msix{w, 4). 

^ This is that irregardless of whether or not d contains a built-in modus poncns rule, it does 
support some form of a (possibly quite lengthy) proof of a theorem Z, when it is able to prove X, Y and 
{X AY) — )• Z as theorems. 
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An example will now illustrate the approximate structure of an inductive method- 
ology for mapping A^^ formulae onto their equivalent Aq counterparts in the Standard-M 
model. Let SQUARE(xi, X2, 2:3, tt;) be a Aq formula which specifies that STRING(.xi, .T2, X3) 
represents an integer < w'^ . Also, let (f)*{xi,X2,x^i) and (t){v) represent a pair of Aq and 

formulae that are equivalent under the Standard-M model when STRING(xi, X2, xs) 
is an encoding for v . Then one possible method for mapping A^^ formulae onto their 
equivalent Aq counterparts (in the Standard-M model) could map the formula (10) onto 
(ll)'s alternate form: 

\/ V <w'^ 4){v) (10) 

V xi < Max(w;, 2) V X2 < Max(u;, 2) V X3 < Max(t«, 2) 

{ SQUARE(xi,X2,X3,ti;) 0*(xi,X2,X3) } (11) 

Lemma 3.6 indicates Example 3.5's translational methodology generalizes easily to all 
combinations of A^^ inputs and generic configurations ^ , via an approximate inductive 
generalization of the transition from sentence (10) to (11). (Its procedure essentially 
performs iteratively a finite number of such transitions, so as to translate all the clauses 
of an initial Aq formulae into their Aq counterparts via an inductive methodology. The 
intuition behind these transitions is they will repeatedly replace a single variable, such 
as in sentence (10), with a multiplicity of variables, such as (xi,X2,X3) in (11).) 

Lemma 3.6 (Paris-Dimitracopoulos [28] ) For every generic configuration ^, each 
Aq formula can be translated into an equivalent Aq formula in the Standard-M model 
via a generalization of Example 3.5's process. (This clearly implies formulae can also 
be translated into Hj expressions.) 

Paris-Dimitracopoulos [28] sketched an analog of Lemma 3.6's translation algorithm, 
using only slightly different notation, that is applicable to any formalism that satisfies 
Parts (1) and (2) of Definition 3.4. Their formalism thus uses an inductively-iterated 
analog of the prior example's replacement of a single variable v in formula (10) with 
(ll)'s multiplicity of variables (xi,X2,a;3) , so as to perform Lemma 3.6's translation 
task. It will be unnecessary for a reader to consider the details behind [28] 's Theorem 
1 or Lemma 3.6's similar translation mechanism because the remainder of this article 
will never use them again. Instead, their sole purpose has been to provide an implicit 
backdrop for our results by illustrating how the study of the 11^ sentences of Definition 
3.4's generic configurations provides information about 11^ sentences (after the needed 
translating is done). 

Four examples of self-justifying systems that employ Definition 3.4's Ilf sentences 
will be illustrated in Appendix D . These examples are too complicated to be examined 
before Sections 3-6 are read. However, the next example should convey some useful 
intuitions: 
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Example 3.7 Let xo,xi,X2, ■■■ and yo,yi,y2, ■■■ denote sequences defined by: 

xo = 2 = yo (12) 

Xi = Xi-i + Xi-i (13) 

yi = yi-1 * Vi-i (14) 

For i > Q , let (f)i and V'i denote the sentences in (13) and (14) respectively. Also, let 00 
and ipo denote (12)'s sentence. Then (t>i^ ■■■^n imply x„ = 2^'^^ , and V'l) •••V'n 
imply Un = 2^" . Thus, the latter sequence grows at a faster rate than the former. 
Much of our research has used the difference between the growth rates of xq, a;i, X2, ... 
and j/O) 2/1) 2/2, •■• as a motivating example explaining why Equation (2)'s Type- A axiom 
systems can support a stronger form of boundary-case exception to the semantic tableaux 
version of the Second Incompleteness theorem than can Type-M systems. 

Let Log( Un ) = 2" and Log( Xn) = n + 1 thus designate the lengths of the binary 
codings for y„ and .t„ . Then y„ 's coding has a length 2" , which is much larger 
than the n + 1 steps that ^l^o, ^i, ji use to define its existence. However, x^ s 
length has a smaller size of n + 1 . These observations are useful because every proof 
of the Incompleteness Theorem involves a Godel number z coding a sentence that has 
a capacity to self-reference its own definition. The faster growing series yo, yi, , 
should be intuitively anticipated to have this self-referencing capacity because y„ 's 
binary encoding has a 2"+^ length that dwarfs the size of the 0{n) steps used to define 
its value. Leaving aside [62, 67] 's many details, this fast growth explains roughly why 
many Type-M logics satisfy the semantic tableaux version of the Second Incompleteness 
Theorem. 

This paradigm also illustrates intuitively why some Typc-A systems, employing 
[59, 61, 64]'s semantic tableaux formalism, can represent boundary-case exceptions to 
the Second Incompleteness Theorem. This is because such formalisms lack access to 
Equation (3)'s axiom that multiplication is a total function. (They arc unable, thus, 
to easily construct numbers z that can self-reference their own definitions because they 
have access only to the slower growing addition primitive.) In particular assuming only 
that each sentence in the axiom-sequence 4>o,4>i, ■■■(pn (from Equation (13) ) requires a 
mere two bits for its encoding, the length n + 1 of x^s binary encoding will be smaller 
than the length of its defining sequence. 

This short length for Xn had motivated [59, 61, 64, 65]'s evasion of the semantic 
tableaux version of the Second Incompleteness Theorem. It suggested that the self- 
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referencing needed in a Godel-like diagonalization argument would stop being feasible 
when Equation (13)'s slow-growing xi, X2, X3, ... sequence represents the fastest growth 
that is possible. 

One of the several goals in this article will be to formalize a generalizations of [59, 
61, 64, 65] 's self-justifying methodologies by using Definition 3.4's generic configurations. 
The proofs of our main theorems will, of course, be more subtle than the hand-waving 
intuitions appearing in this example. For instance, the combined work of Pudlak, Solovay, 
Nelson and Wilkie-Paris [26, 33, 44, 58] (summarized by Theorem 2.1) raised the subtle 
issue that no Type-S system can prove a theorem affirming its own Hilbert consistency. 
Another complication is that the Equation (14) 's implication for proofs that use the 
multiplication operative has different side effects for Herbrandized and semantic tableaux 
deduction (on account of Kolodziejczyk [20, 21] 's previously mentioned observations 
about the potential exponential difference between the lengths of these proofs under 
extremal circumstances) . 

Our main theorems will show that self-justifying systems, using four deduction meth- 
ods, are capable of proving all of Peano Arithmetic's 11^ theorems. Interestingly, self- 
justification will be compatible with [64] 's modification of semantic tableaux deduction, 
that includes a modus ponens rule for Ilf and sf type sentences. However, [63] has shown 
an analogous modus ponens rule for Eg and S2 sentences is incompatible with self jus- 
tification. (Thus, the contrast between our main results and the Second Incompleteness 
Theorem's generalizations will be quite tight.) 

4 Five Helpful Definitions and An Informative Lemma 

This section will introduce five definitions and prove a Lemma 4.6 about self justification. 
This lemma will be weaker than Sections 5 and 6's main results. Its main purpose will 
be to provide a useful starting example. 

Definition 4.1 The symbol "E(n)" will denote some term in Definition 3.4's lan- 
guage that represents the value 2" . In using this symbol, we do not presume that 
possesses a function symbol for the exponent operation. Thus if has only a function 
symbol for multiplication, then E(n) could designate the term of "2 * 2 * ... * 2" with 
n repetitions of "2" . (Alternatively, E(n) can be defined via applying 2" iterations of 
the successor function to zero, or by having a special constant symbol designating 2" 's 
value. Essentially, any reasonable method can be used to define E(n)'s value) 
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Definition 4.2 Let T denote a prenex normal sentence. Then Scope£;(T,N) will 
denote a sentence identical to T except that every unbounded universal quantifier 
" V w " is changed to "Vf < E{N)" , and every unbounded existential quantifier "3^; " 
is changed to "3^ < E{N)". (No change is made among the bounded quantifiers 
within the Aq part of the sentence T .) For example, if T denotes the 11^ sentence 
of Vui \/ V2 ... Vffc ^(f 1, f2, ...ffc) then (15) illustrates Scope£;(T,N)'s form. Likewise 
if T is the sentence of 3vi 3v2 ■■■ (f){vi,V2, ■■■Vk) then (16) illustrates 

Scopes (T,N)'s form. 

Vwi < E{N) < E{N) ...Vvfc < E{N) : c^{vuV2, -.Vk) (15) 

3vi < E{N) 3v2 < E{N) ...3 Vk < E{N) : (f){vuV2, ...Vk) (16) 

Special Note about Definition 4.2's Meaning. If T is a Aq sentence then 
Scopes (T, iV) will be equivalent to T for every AT > by definition. (This is because 
A^ formulae contain no unbounded quantifiers that undergo change when T is mapped 
onto Scope£;(T, A?^). ) 

More About this Notation: The potentially lengthy syntactic object of " ScopeE(T,N) 
will actually not be used in our physical encodings of proofs. Instead, these encodings 
will use the more desirably compressed object of " T " (which has no possibly bulky E{N) 
term). The sole function of ScopeE(T,N) will be for us to speculate about what Boolean 
value T would theoretically assume (under the Standard-M model) if T 's quantifiers 
were modified so that their ranges were changed to be bounded by E{N). (It turns out 
that ScopeE(T,N) 's finitized quantifier-range will help simplify our analysis.) 

Definition 4.3 A Tlf or e| sentence T will be called Good(N) when the entity 
Scopes (T, N) is true under the Standard-M model ^. Also, a set of Ilf sentences, denoted 
as 9, is called Good(N) iff all of its sentences are Good(N). 

Definition 4.4 If T is a Ilf sentence then tt( T) will denote the largest integer J 
such that T satisfies the Good(J) condition. (It will equal oo if T satisfies Good(J) for 
all J.) Also, if ^ is a set of Ilf sentences, then jj( 6 ) will denote the largest J where each 
sentence in 9 is Good (J). 

A Very Helpful Start : Several more definitions will be needed before Section 6 
can present our strongest results. The remainder of this section will illustrate how the 
current formalism is already sufficient for introducing a useful starting lemma. 

® A quite unusual aspect of Definition 4.3 is that its Good(A/') condition has opposite properties when 
it is applied to Ilf and Ef sentences in one particular respect. This is because for each N, the Good( N ) 

condition is weaker than the Good( oo ) condition for IIj sentences, while it is stronger than it for 
sentences. (For instance, Vx 0(a;) is stronger than Vx < E{N) 4>{x) , but 3x 4>{x) is weaker than 
3 a; < E{N) (j){x) .) 
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Definition 4.5 Let {L^ , A^, , clG) again denote a generic configuration called 
^ , and let us presume that its base axiom system is comprised exclusively of Ilf 
sentences. Also, let /3 D B^ denote a second axiom system, comprised also of 11^ 
sentences, that (unlike B^ ) can possibly be inconsistent. (If (3 is inconsistent then let 

denote the shortest proof of = 1 from /3 . ) Then the generic configuration ^ 
will be called Tight if iff every inconsistent set of 11^ sentences P D satisfies the 
following constraint: 

^og{q0) > tt(/3) + 2 (17) 

Lemma 4.6 will prove i?^+SelfRef(i?^, d) satisfies Section I's self-justification criteria 
whenever ^ is tight. This "tightness" will clearly fail to be satisfied by many generic 
configurations. This is because the Second Incompleteness Theorem is a widely encom- 
passing result, which imposes severe restrictions on its allowed exceptions. Lemma 4.6's 
mini-result will be of interest primarily because it will be generalized substantially in 
Sections 5 and 6. 

Lemma 4.6 // a generic configuration (L^, Aq, B^,d, G) is tight then B^+SelfRef{B^ , d) 
will he a consistent self-justifying axiom system. 

Proof Sketch: Our justification of Lemma 4.6's mini-result will be simpler than the 
next section's proof of Theorem 5.9's stronger result. The current proof will also be kept 
brief and informal because the same topic will be visited more rigorously during Section 
5's discourse. 

Let ^ denote Section I's SelfRef(i?^, d) sentence. We will omit formalizing ^ 's 
exact encoding here because Appendix A will provide a more general fixed-point 
construction, using Definition 5.7's stronger paradigm. The current proof will simply 
presume ^' 's fixed point statement can receive a 11^ encoding under sentence (18), 

where " Prf^BS+SeifRef(B« d)^ \^ ~ ■> P ) '^^ ^ formula, indicating that p is a 
proof of 0=1 from B^ + SelfRef(-B^, d) under d 's deduction method. 

V p ^ PrfB.+SelfRef(S«,d)( [0 = 1] , p ) (18) 

The Definition 4.4's symbol jj will be helpful at this juncture. The application 
of ^'s tightness to (18) 's 11^ styled encoding will imply ^ that (19) must be true when 
^ is false under the Standard-M model and when the shortest proof of = 1 from 
B^ + SelfRef(5«,d) is denoted as q. 

Log(g) = tt(*) + 1 (19) 

^Equation (19) is easy to justify when one presumes there is an available Y[\ encoding of (18)'s 
statement, which we call . (This 11^ presumption is reasonable because an analog of ^ 's exact Ii\ 
encoding will be discussed later by Definition 5.7 and in Appendix A.) The invalidity of ^ will thus 
assure the existence of a proof of = 1 from + SolfRcf(i3*, d). Moreover, Definition 4.4's notation 
implies U( ^' ) will equal Log(g) — 1 when q denotes the shortest proof of = 1 from -\- SelfRef(-B^, d). 
The latter shows (19) is valid. 
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Also Definition 4.4 trivially implies ^{ + ^ ) = tl( ^ ) (because all of 's axioms 
are true under the Standard-M model). Thus, (19) yields (20). 

Log(g) = tt(5« + *) + 1 (20) 

But the point is that the Tightness constraint's Equation (17), used in the context where 
/3 is the axiom system of B^ + , implies Log{ q ) > t|( B^ + ) + 2 . This 
directly contradicts Equation (20) 's equality, whenever the proof " q " of = 1 cited 
in our discussion does formally exist. This contradiction is precisely what is needed to 
corroborate Lemma 4.6's claim that the axiom system B^ + SelfRef(S^, c?) must be 
consistent. (Thus, B^ + SelfRef(i?^, d) must be consistent because otherwise a proof 
g of = 1 would exist and have its Log(q') > jJ(S^ + *) + 2 inequality contradict 
Equation (20).) □ 

How Lemma 4.6 May Be Interpreted : We remind the reader that many (but 
not all) generic configurations will fail to satisfy Lemma 4.6's tightness hypothesis. This 
is because any configuration satisfying this hypothesis represents one of those unusual 
boundary-case exceptions to the Second Incompleteness Theorem that are feasible. 

Lemma 4.6 was intended to capture the simplest variant of a self-justifying phenom- 
ena (that employs Definition 4.4's machinery) . Its proof was kept informal because more 
sophisticated self-justifying formalisms will be explored in Sections 5 and 6. They will 
apply to four different types of generic configurations, each of whose base axiom systems 
B^ can be made capable of proving all Peano Arithmetic's 11^ theorems — in a context 
where these systems use a broader variant of "/ am consistent" axiom-statement than 
does Lemma 4.6's "SelfRef(S«, d)" sentence. 

5 The First Two Meta-Theorems about Self-Justification 

The core theorems in this section will employ the following notation: 

1. The symbol 9 will denote any recursively enumerable (r.e.) set of nf sentences, 
henceforth called a R-View. (An R-View does not need to be valid under the 
Standard-M model. It only needs to be r.e.) 

2. RE-Class(,^) shall denote the set of all possible "R- Views" 9 that can be built out 
of 's language . (This permits both valid and invalid R- Views to appear in 
RE-Class(^). We choose this unrestricted definition because no recursive decision 
procedure can identify all the true 11^ sentences in the Standard-M model.) 



15 



Definition 5.1 Let ^ denote the 5-tuple (L^, Aq, B^, d, G) representing one of Def- 
inition 3.4's generic configurations, and let RE-Class(^) and its R- Views "0" be defined 
as in the previous paragraph. Then ^ is called A-Stable iff each 6 G RE-Class(^) 
satisfies the following invariant: 

* If T is a theorem of axiom system 9UB^ via a proof p whose length satisfies 
Log(p) < i{9) +1 then T will satisfy Good{ i 'A{ 0) } . 

Remark 5.2 The invariant * states short proofs (with lengths < [j( 0) +1 ) will 
produce at least partially useful deductions, in that their 11^ theorems will always satisfy 
Good{ i tJ( ^) }) irregardless of whether or not 0's axioms are technically true. (This 
makes the study of A-stability very interesting unto itself, apart from its applications in 
the current article). 

Theorem 5.11 will show the presence of A-stability, alone, is sufficient for constructing 
self-justifying systems. This will imply every A-stable configuration must contain some 
embedded weaJcness (as every evasion of the Second Incompleteness Theorem always 
does). On the other hand, Appendix F will explain how A-stability and its "EA-stable" 
cousin (defined later) are both epistemologically interesting. Thus, A-stability has re- 
deeming features. 

Definition 5.3 A Generic Configuration ^ will be called E-Stable iff all of the 
6 G RE-Class(^) satisfy * * . (This construct is the counterpart for T,\ sentences of 
the Item * in Definition 5.1.) 

** If T is a theorem derived from the axiom system 9 U via a proof p 
whose length satisfies Log(p) < ^{9) + 1 then T will automatically satisfy 
Good{ ^ [ Logip) J — 1 } . (This invariant further implies ^ that T will also 
satisfy the Good{ i tJ( ^) } criteria.) 

Remark 5.4 The invariants * and ** are partially analogous to each other because 
both imply that if p is a proof short enough to satisfy Log(p) < jj( 0) + 1 then 
their resulting theorem will satisfy Good{ ^ tt( ^) } • However, there is a distinction 
between Definitions 5.1 and 5.3, as well. This is because the prior section's Footnote 
6 observed that sentences are stronger when they meet a Good( ) rather than a 
Good( oo ) threshold, while the reverse is true for Il\ sentences. Thus ** 's short proofs 
p (satisfying Log(p) < tJ( ^) + 1 ) will have the special property that their theorems 
T will satisfy a "Good{ ^ [ Log(p) J — 1 } " constraint that is actually stronger than 
their formal sf statements. 

*This point is easy to confirm when one remembers that Sf sentences T have the property 

that A < B imphcs Scope_E(T,^) is stronger than Scopc_E(T, B). It is then obvious that the 
Good{ 1 |_ Log(p) J — 1 } criteria implies the validity of Good{ ^ tt( ^) } for Ej sentences 
because the invariant ** presumes its Sf theorems have proofs p satisfying " Log(p) < tt( ^) + 1 "■ 



16 



The Appendix D will provide four examples of generic configurations that are either 
E-stable or A-stable (or often both). Its most prominent example will be a configuration 
^* that uses semantic tableaux deduction and recognizes addition as a total function. 
Theorem D.4 will imply such systems can be made self-justifying and able to prove Peano 
Arithmetic's n| theorems. 

Three more definitions arc needed to help introduce our first theorem 

Definition 5.5 A generic configuration ^ will be called EA-stable iff it is both 
E-stable and A-stable. (It will thus satisfy both * and * * .) 

Our next definition is related to the fact that many definitions of consistency are 
logically equivalent from the perspective of strong enough logics, but they are often not 
provably equivalent from the perspectives of weak logics. 

Definition 5.6 Let ^ denote the generic configuration (L^, Aq, B^, d, G), and a be 
an axiom system satisfying a D B^. Then a is called Level(A;^) Consistent when there 
exists no proofs from a via d's deduction method of both a n| sentence and of the S| 
sentence that is its negation 

Most of this article will focus on self-justifying systems that recognize their Level(A;^) 
consistency when k equals or 1. Our next definition will be applied mostly to these 
two cases. 

Definition 5.7 Given any fc > 0, a generic configuration (L^,AQ,B^,d,G) and an 
axiom system P D B^, the symbol SelfCons'^(/3, c?) will denote a self-referencing Ilf 
sentence declaring /3-|-SelfCons*^(/?, (i)'s formal Level(k^) consistency, as is illustrated 
below by the statement -|- . (An encoding for SelfCons'^(/3, c/) will be provided by 
Appendix A.) 

+ There exists no two proofs (using deduction method d) of both some 
n| sentence and of the s| sentence, that represents its negation, from the 
union of the axiom system /3 with this added sentence "SelfCons*^(/3, d) " 
(looking at itself). 

Remark 5.8 Wc will focus on Definition 5.7's SelfCons'^(/3, d) axiom mostly in the 
settings where = or 1. This is because SelfCons'^(/3, d) will typically be too strong 
for it to generate boundary-case exceptions to the Second Incompleteness Theorem when 
k > 2 . It turns out that even when k = 1 , Definition 5.7's SclfCons^(/3, d) state- 
ment will be significantly stronger than the axiomatic declaration • used by Section I's 
SelfRef(/?, d) axiom. This is because SelfCons^(/3, d) asserts non-existence of simultane- 
ous proofs for a sentence and its negation, while SelfRef(^, d) establishes merely 
the non-existence of a proof of = 1. 
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Theorem 5.9 Let ^ denote a generic configuration {L^ , Aq, ,d,G) that is EA- 
stable. Then the corresponding axiom system of B^+SelfCons^{B^,d) must satisfy Sec- 
tion 1 's definition of self-justification. 

Proof. The justification of Theorem 5.9 will be a more elaborate version of Lemma 
4.6's mini-proof. It will replace Definition 4.5's Tightness constraint with an EA-stability 
requirement. It will also replace SelfRef(/3, d)'s "I am consistent" axiom with a stronger 
SelfCons^(/3, d) statement. 

Our proof will focus on showing i3^+SelfCons^(i?^, d) is consistent (and thus satisfies 
the subtle Part-ii component of Section I's definition of "Self- Justification" ) . It will be 
awkward during our discussion to write repeatedly the expression " i?^+SelfCons"'^(i?^, d) " 
Therefore, "S"' will be the abbreviated name for this axiom system. We will also employ 
the following notation: 

1. PTfs{t,p) will denote that ^? is a proof of the theorem t from the above 
mentioned formalism " S " (using ^'s deduction method of d ). 

2. Neg^(a;,y) will denote that x is the Godel encoding of a 11^ sentence and that 
y is a sentence which represents x 's formal negation. 

Appendix A explains how to combine the theory of LinH functions [15, 23, 69] with 
[61] 's fixed point methods to provide PTfs{t,p) and Neg^(a;,y) with Aq encodings. (A 
reader can omit examining Appendix A, if he just accepts this fact.) Thus, (21) can be 
viewed ^ in this context as being SelfCons^(S^, d) 's formalized nf statement, declaring 
the Level(l^) consistency of S: 

yxyy^pyq - {Neg\x,y) A Pris{x,p) A Pvis{y,q)} (21) 

Let $ denote (21) 's sentence. We will use it to prove Theorem 5.9's claim that S is 
consistent. Our proof will be a proof by contradiction. It will begin with the assumption 
that S is inconsistent. This implies $ is false under the Standard-M model. Hence, 
Definition 4.4 implies 

tt($) < GO (22) 

Equation (22) thus indicates there exists {p,q,x,y) satisfying (23) (because such a tuple 
will be a counter-example to (21) 's assertion). The particular {p,q,x,y) satisfying (23) 

^Our notation convention has the abbreviated formula of " Prfs(f,p) " in Equation (21) corresponding 
to Appendix A's " SubstPrf^ {n,t,p) " formula, in a context where n specifics the Godel rmmber of 
the expression (p) in Appendix A's Equation (36) and where the superscript k within this formula 
" r*'(g') " is set equal to 1. This implies that sentence (21) does assert the Level(l^) consistency of S. 
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with minimum value for Log{ Max[p, q, x, y] } can then be easily shown to also satisfy 
Equation (24). 

Negi( X , y ) A Prf5 ( a; , p ) A Prf5 ( y , g ) (23) 

Log { Max[ p, q, X ,y] } = «($) + ! (24) 

We will now use (23) and (24) to bring our proof-by-contradiction to its conclusion. 
Let T denote the sentence specified by x . Then -i T will correspond to the 
sentence denoted by y . Also, (23) and (24) imply that both T and -> T have proofs 
such that the logarithms of their Godel numbers are bounded by jl( $ ) -|- 1 . These 
facts imply that T and -iT both satisfy Good{ ^ [}($)} under our formalism. 
(This is because if we take 9 in Definitions 5.1 and 5.3 to be simply $ 's 1-sentence 
statement, then the invariants of * and ** from these two definitions both impose the 
same Good{ ^ jj( $) } constraint on T and -i T .) 

It is infeasible, however, for a sentence and its negation to both satisfy the same 
goodness constraint. This completes Theorem 5.9's proof-by-contradiction because the 
initial assumption that S was inconsistent has led to an infeasible conclusion. □ 

Our next definition will help formalize a useful cousin of Theorem 5.9. 

Definition 5.10 A Generic Configuration of ^ will be called 0-Stable when every 
particular 6 € RE-Class(^) satisfies the invariant of * * *. (This invariant is strictly 
weaker than its counterparts * and ** in Definitions 5.1 and 5.3.) 

*** If T is a Aq theorem derived from the axiom system 6 U via a proof p 
whose length satisfies Log(p) < '^{9) +1 , then T is true under the Standard-M 
model. 

Theorem 5.11 If the configuration ^ is 0-stable then B^+SelfCons^{B^, d) is a self- 
justifying formalism. (Appendix C shows this result applies also to E-stable and A-stable 
configurations.) 

Theorem 5.11's proof is similar to Theorem 5.9's proof. The difference between these 
two propositions is that Theorem 5.11 has reduced SclfCons's superscript from 1 to 0, 
so that its hypothesis can encompass a theoretically broader set of applications. (The 
Appendix C summarizes how Theorem 5.9's proof can be easily modified to also prove 
Theorem 5.11.) 

Let L denote the minimum value for Log{ Max[p, q, x, y] } for a tuple (p, q, x, y) satisfying Equa- 
tion (23). Then by definition, $ satisfies Good(L — 1) but not Good(I/). From Definition 4.4, this 
establishes the validity of Equation (24) (because the minimal (p, q, x, y) satisfying sentence (23) has 
Log{Max[p, q, x, y]} = L. ) 
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Remark 5.12 Theorems 5.9 and 5.11 should clarify the nature of [59]-[68]'s for- 
malisms. This is because proofs-by-contradictions are notorious in the mathematical 
literature for being confusing. They should be simplified whenever possible. This has 
been done mainly through Theorem 5.9's short proof. (It applies to three of Appendix 
D's four examples of generic configurations, and Theorem 5.11 applies to Appendix D's 
fourth example.) Furthermore, Section 6 will show how more elaborate self-justification 
systems can verify all Peano Arithmetic's nf theorems. 

6 Four Further Meta-Theorems 

We need one preliminary lemma before exploring how strong self-viewing logics may 
become before they cross the inevitable boundary between self-justification and incon- 
sistency, implied by Godel's Theorem. 

Lemma 6.1 Let ^ denote a generic configuration (L^, Aq, B^, d, G) , and 9* denote 
an r.e. set ofnf sentences, each of which holds true in the Standard-M model. Let ^* 
denote a 5-tuple that differs from £^ in that its base axiom system is U 9* (rather than 
B^). These conditions imply that ^* is a generic configuration, and it will satisfy the 
following four invariants: 

i If ^ is 0-stable then ^* will also be 0-stable . 

ii // ^ is A-stable then ^* will also be A-stable . 

iii If ^ is E-stable then ^* will also be E-stable . 

iv // ^ is E A-stable then ^* will also be E A-stable . 

Lemma 6.1's proof is fairly straightforward. It has been placed in the Appendix B. 
This section will use Lemma 6.1 to prove four meta-theorems that are consequences of 
its formalism. 

Definition 6.2 Let ^ again denote a generic configuration (L^, Aq, i?^, d, G), and 
9 denote some r.e. set of 11^ sentences (which are not required to be true under the 
Standard-M model). For the cases where k is either or 1, the symbol G^{9) will 
denote the following axiom system: 

G|(0) = 9 U U Se\iCons''{[e U ] ,d} (25) 

Also when A; = or 1, the function G| (which maps 9 onto G^{9) ) is called Con- 
sistency Preserving iff G^{9)is assured to be consistent whenever all the sentences 
in 9 are true under the Standard-M model. 

We emphasize consistency preservation is unusual in logic. This is because G|(^) 
comes from adding a self-justifying axiom to an initially consistent formalism B^-\-9 , and 
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the Second Incompleteness Theorem demonstrates that sufficiently powerful formalisms 
are simply incompatible with such an axiom. However, there will be four specialized 
paradigms, defined in Appendix D, that are exceptions to this rule. They will be related 
to our next result: 

Theorem 6.3 The function shall satisfy Definition 6.2's consistency preser- 

vation property when ^ is EA-stable. Likewise the function Gq will be consistency 
preserving when is any one of A-stable, E-stable or 0-stable. (Thus in each case, 
( ^ ) will be consistent when all the sentences in 9 are true in the Standard-M 
model.) 

Proof. It will be convenient for our proof to use a dot-style notation, analogous to 
Lemma 6.1's terminology. Thus, 

1. 9* denotes any r.e. set of Ilf sentences that are each true under the Standard-M 
model. 

2. is the tuple (L^ , Aq , U 9* , d , G). (It differs from ^ by replacing ^ 's base 
axiom system of with B^ U 9*.) 

Part-iv of Lemma 6.1 indicates the EA-stability of implies the EA-stability of More- 
over Theorem 5.9 applies to all EA-stable configurations, including Thus, G^(0* ) is 
consistent because ^ is EA-stable and all of 9* 's sentences are true in the Standard-M 
model. This proves Theorem 6.3's first claim. 

An almost identical proof, where Theorem 5.11 simply replaces Theorem 5.9 as the 
central self-justifying engine, will corroborate Theorem 6.3's second claim . Thus, Gq 
is consistency preserving when ^ is one of A-stablc, E-stable or 0-stable. □ 

Remark 6.4 Most generic configurations ^ will not satisfy Theorem 6.3's hypoth- 
esis because G|(^) will typically be inconsistent, irregardlcss of whether or not all 
of 9 's axioms arc valid under the Standard-M model. The significance of Theorem 6.3 
is that it shows that some outlying exceptions to this general rule do prevail when ^ 
satisfies one of Theorem 6.3's four stability conditions. These exceptions are related to 
the 3-pagc abbreviated philosophical discussion that will appear later in Appendix F. 
They will assure that Theorem 6.3's formalisms of gI{9) and Gq{9) are always consistent 
whenever 9 's axioms are valid in the Standard-M model. 

Our next definition will enable self-justifying formalisms to prove the 11^ theorems 
of any consistent r.e. axiom system that uses 's language. 

Definition 6.5 Let denote a generic configuration (L^, Aq, B^, d, G). Let B denote 
any recursive axiom system whose language is an extension of . For an arbitrary 

^^Conventional generic configurations ^ will satisfy the Hilbert-Bernays derivability conditions [16, 15]. 
Their G^(^) will thus be automatically inconsistent because of a Godel-like diagonalization argument. 
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deduction method T> (which may be possibly different from ^ 's deduction method d ), 
let Prff ( [ ^' ] , g ) denote a formula indicating g is a proof of the theorem ^' from 
axiom system B , using deduction method D . Then the Group-2 Schema for (B, T>) 
is defined as an infinite set of axioms that includes one instance of (26) 's axiom for each 
sentence ^ . 

Vg {Prff(r*l,g) ^ } (26) 

Comment about this Notation: The Definition 6.5 had called (26) a "Group-2 
Schema" so as to keep our terminology consistent with [59, 61, 64, 66] 's notation. 

Theorem 6.6 Let ^ denote any arbitrary generic configuration, and (B,!)) denote 
any pair consisting of an axiom system and a deduction method (which, once again, are 
allowed to be different from ^ 's deduction method and axiom system). Then if all of 
{B, V) 's Il\ theorems are true in the Standard-M model, the following two invariants will 
hold: 

i If ^ is EA-stable then there will exist an r.e. self-justifying system that can prove 

all of (B^V) 's n| theorems and recognize its own Level( 1^ ) consistency. 

ii Likewise, if ^ is one of A- stable, E-stable or 0-stable, there will exist an r.e. self- 

justifying system that can confirm all of {B,!)) 's Ilf theorems and which can rec- 
ognize its own Level( 0^ ) consistency. 

Proof. Theorem 6.6 follows from Theorem 6.3. Thus let 9 denote the set of all 
sentences that are members of Definition 6.5's Group-2 schema. Then every one of 
6 's Group-2 axioms must be true under the Standard-M model (because the hypothesis 
of Theorem 6.6 indicated all of (H,P)'s Tl\ theorems are true in this model). Hence, 
Theorem 6.3 implies: 

1. G\{9) \s consistent when ^ is EA-stable. 

2. Gq{9) \s consistent when ^ is one of A-stable, E-stable or 0-stable. 

Since G^q{6) and G\{6) are self-justifying systems that prove all of {B, P)'s nf theorems. 
Items 1 and 2 will substantiate Theorem 6.6's two claims. □ 

An awkward aspect of Definition 6.5's "Group-2" schema is that it employs an infinite 
number of instances of (26) 's Group- 2-like axiom sentences. It turns out that this Group- 
2 scheme can be compressed into a single axiom sentence, if one is willing to settle for a 
slightly diluted variant of {B, X')'s 11^ knowledge. To formalize this concept, the following 
notation shall be used: 
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1. Check^(t) will denote a Aq formula that checks to see whether t represents the 
Godel number of a n| sentence. 

2. Test^(i,x) will denote any Aq formula where (27) 's invariant is true under the 
Standard-M model for every sentence * simultaneously. There are infinitely 
many different Aq formulae that can serve as Test^(t, x) predicates satisfying this 
condition. (Example 6.7 will illustrate one such encoding of a Test^ (t, x) predicate.) 

* ^ V a; Test^( [ * ] , a; ) (27) 

The expression (28) will be called a Global Simulation Sentence for representing 
{B,V) via ^ . Its Test^(t, x) clause essentially allows ^ to simulate the n| knowledge of 
(i3,P)'s set of theorems. 

Vt Vg Vx { [ Prf^(t,g) A Check^(t) ] Test^{t,x) } (28) 



Example 6.7 For any generic configuration ^ = {L^, A.^, B^,d,G), let NegPrf'^ (t, x) 
denote a Aq formula specifying that t is a 11^ sentence and that x is a proof under d 's 
deduction method of the sentence that represents t 's negation. Also, let Testp {t, x) 
be defined as follow: 

Test^(t,x) =(igf - NegPrf^(t,x) (29) 

For each nf sentence it is easy to verify that the statement (30) is true under the 
Standard-M model. 

* <^ V X Test^( r * ] , X ) (30) 

The latter implies that (31) is a global simulation sentence for {B,V). 

Vt Vx { [ Prff (t,g) A Check^(t) ] Test^(i,x) } (31) 

We emphasize that there are countably infinite different examples of Test|(t,x) predi- 
cates that generate global simulation sentences and that statement (31) illustrates only 
one such example. 

Definition 6.8 Let {B,!)) denote any ordered pair whose set of Tl\ theorems are 
true under the Standard-M model. Let Testf , Testg , Testg .... denote the set of 
Aq formulae where statement (27) is true under the Standard-M model for every Il\ 
sentences Then TestList^ will denote a list of all these Testf predicates. Also for 
each Test| formula in TestList^ , the symbol GlobSim^ (C, j) will denote the special 
version of (28) 's global simulation formalism that employs Test| 's machinery. 

^^Part-3 of Definition 3.4 indicated that (, 's base axiom system is " complete" . (It is thus able 

to prove all Ej sentences that arc true in the true in Standard-M model, and it will likewise refute all 
sentences that are false.) The statement (29) then immediately implies that (30) must be true under 
the Standard-M model for every Ilf sentence . 
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Remark 6.9 A comparison between Definition 6.5's Group-2 schema with 6.8's 
global simulation sentences will reveal neither is strictly better than the other. Both 
have their own separate advantages. Thus, the attractive aspect about Definition 6.8's 
GlobSim^ sentence is that it is a finite-sized object that can simulate the infinite 

set of axioms associated with Definition 6.5's Group-2 schema. The accompanying draw- 
back of a global simulation sentence is that the union of it with the base-axiom system 

will typically be inadequate to prove every nf sentence that is a theorem of {B,V). 
Instead, in a context where is a Ilf theorem of {B,V), the sentence GlobSimg j) 
will usually provide only enough fragmented information to prove the statement (32) 
(which is equivalent to * under the Standard-M model). 

V X Tcst|( [ ^' ] , X ) (32) 

While (32) may be insufficient to prove ^ from , it still (according to the statement 
(27) ) has the desired property of being equivalent to ^' under the Standard-M model. 
(This means that the knowledge of (32) 's truth is helpful, even if it is unknown from 
B^ 's perspective to be equivalent to ^' . ) 

Our prior articles [59, 61, 64, 66] did not use Definition 6.8's global simulation formal- 
ism. They employed, instead. Definition 6.5's Group-2 axiom schema. Theorem 6.10 will 
be the analog of Theorem 6.6 for global simulation. It will be useful when one desires to 
compress all the information held by a Group-2 schema into a single finite-sized object. 

Theorem 6.10 Let ^ denote the generic configuration (L^, Aq, i?^, d, G), B denote 
a recursively enumerable axiom system and T> denote any deduction method (which can 
be different than ^ 's deduction method d ) . Suppose that all the Ylf theorems generated 
by (B , V) are true under the Standard-M model. Then the following invariants do hold: 

i If ^ is EA-stable then for each j there exists a finitized extension /3j of 

B^ that recognizes its Level{l^) self- consistency and which contains the sentence 
GlobSim§{^,j). 

ii Likewise for each j, if ^ is E-stable, A-stable or 0-stable then there exists a fini- 

tized extension of B^ that recognizes its Level{0^) self-consistency and which 
contains the sentence GlobSim^ (Cij)- 

Proof: Let 9 denote the 1-sentencc R-Vicw of "GlobSini^ (^,j)" formalized by 
Definition 6.8, and let /?] and ^° denote B^ U 6* -h SelfCons^ ( S« U 6) and 

^^The chief difficulty arises essentially because a fff theorem of {B,T>) may contain an arbitrarily long 
combination of bounded universal and bounded existential quantifiers. Thus, some generic configurations 
will have base axiom systems that are so weak that their combination with (28) 's Global Simulation 
Sentence is insufficient to prove the validity of (27) 's equivalence statement for all Il\ sentences ^ 
simultaneously. In particular, such proofs will often be infeasible when ^ 's sequence of bounded quantifies 
has a length greatly exceeding the length of the Godel encoding for (28)'s global simulation statement. 
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U 6' + SclfCons°(5« U 0), respectively. These axiom systems correspond to the 
objects that Definition 6.2 had caUed Gi{9) and Go(^)- 

Theorem 6.10's hypothesis indicates all the Il\ theorems of {B,V) are true under the 
Standard-M model. Thus, it follows that 9 is also true in the Standard-M model. Hence 
Theorem 6.3 implies that Pj = Gi{9) is a consistent system satisfying Theorem 6.10's 
claim (i). Likewise, Theorem 6.3 implies j3j = Gq{9) satisfies Theorem 6.10's second 
claim. □ 

Remark 6.11 Theorems 6.6 and 6.10 raise a fascinating question: Is the trade-off 
between these formalisms needed? That is, can self-justifying systems use only a a finite 
number of added axioms beyond those lying in ^ 's base system of and also duplicate 
all {B,V)'s Il\ theorems in a pure sense (i.e. without simulation) ? We will return to 
this topic in Appendix G. 



REFLECTION PARADIGMS : Our last goal is to show how self-justifying 

systems support unusually strong reflection principles. Let ReRecta,di ^ ) denote (33)'s 
statement when ^' is a sentence with Godel number \^~\ , and {a,d) denotes an 
axiom system and deduction method. 

Vp [ Prf„,d( r*l , P) ^ * ] (33) 

Lob's Theorem [15, 25, 42] implies that conventional systems {a,d) , possessing at least 
Pcano Arithmetic's strength, arc unable to prove ReflectQ;^d( ^ ) except for in the 
degenerate cases where they can prove 

Moreover, it is easy to generalize Lob's Theorem (via say [61] 's Theorem 7.2) so that 
a wide class of formalisms a , weaker than Peano Arithmetic, are also unable to prove 
ReflectQ,,(i( ^ ) for all 11^ sentences ^ simultaneously. 

The intuition behind this generalization is quite simple. Let U denote a nf encoding 
for the classic Godel sentence declaring: " There is no proof of me from the axiom 
system a using d 's deduction method". Then [61] 's Theorem 7.2 uses a very routine 
diagonalization argument to show most formalisms a will be inconsistent if they prove 
Reflecta^(i( 15 )'s statement. 

Our next theorem will show, surprisingly, that the preceding limitation is much less 
stringent than it may initially appear to be. This is because Level( 1^ ) self-justifying 
axiom systems are capable of proving very close analogs to (33) 's impermissible 
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reflection principle, using a "translational" methodology. 

Thus, let T denote an algorithm that maps a Il\ sentence * onto a "translated" 
sentence that is equivalent to ^ under the Standard-M model and which is also 
written in a Hf format. (See footnote^^ for why it is absolutely imperative that both 
these requirements be included in T 's definition.) Also, let Reflect^ ^( ^ ) denote the 
translational modification of (33) 's reflection principle that replaces ^ with . 

\/p [ Prf,,rf( r*l , P) ] (34) 

Theorem 6.12 Let denote the EA-stable configuration of {L^,AQ,B^,d,G), and 
let a = B^ + SelfCons^{B^) denote ^ 's corresponding Level(l) self-justifying axiom 
system. Then there will exist a translation methodology T where a can prove the 
validity of (34) for all its Ii\ sentences simultaneously. 

Proof: Let us use Example 6.7's notation. It observed that ^ 's Ilf statement was 
equivalent under the Standard-M model to "Vx Testo( , x)". Thus, let us view T 
as being a mapping of the flrst sentence onto the second. 

Our proof of Theorem 6.12 will next use the following observations: 

1. The non-existence of a proof of ^' from i?^ + SelfCons^ ( ) trivially implies 
the non-existence of a proof of the same theorem from (because the latter 
axiom system is simply a subset of the former). 

2. Moreover, Example 6.7's notation treats "Vx Testo( r^*] , x)" as being equivalent 
to the declaration that no proof of -> * from B^ exists. 

Hence, a can prove (34) 's statement by noting that p's proof of a 11^ sentence 'I' 
implies (via a 's SclfCons^ axiom) the non-existence of a proof of \1' , which (via 
Items 1 and 2) implies "Vx Test^( [^] , x)" □. 

Remark 6.13 : Theorem 6.12 and the statement (34)'s Translational Reflection 
Principle may possibly be useful devices in unraveling some of the mystery that has 
enshrouded Godcl's Second Incompleteness Theorem, since its inception. This is partly 
because Godcl was explicitly uncertain about the generality of the Second Incompleteness 
Theorem in his initial 1931 seminal paper [14] about this subject. His centennial paper 
about Incompleteness thus included the following quite poignant caveat: 

^'^ Part-3 of Definition 3.4 indicated tliat generic configurations are Ej complete. Our requirement 
that must have a 11^ format thus causes T to gain much added meaning. This is because the 

axiom system will then automatically disprove '^^ whenever it is false under the Standaxd-M 
model. (Thus, T's mapping of ^ onto gains much significance when ^ and do rest on the 
same IIj level of the arithmetic hierarchy.) 
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• : "It must be expressly noted that Theorem XI (i.e the Second Incom- 
pleteness Theorem) represents no contradiction of the formalistic standpoint 
of Hilbert. For this standpoint presupposes only the existence of a consis- 
tency proof by finite means, and there might conceivably be finite proofs which 
cannot be stated in ... " 

Some of the issues that troubled Godel in the statement • can perhaps be partially 
resolved if one compares the reflection principles of sentences (33) and (34). This is 

because (33) is probably unnecessary to explain how thinking beings can appreciate 
their 11^ theorems when Theorem 6.12's specialized logics can, instead, use the fact 
that its sentences satisfy at least (34) 's modified reflection principle. Thus, some 
of the mystery surrounding the Second Incompleteness Effect can be clarifled when one 
notices that (34) 's translational reflection princible is a useful precept, that was shown 
by Theorem 6.12 to be technically unrelated to Godel's observation that no reasonable 
formalism can prove (33) 's purist principle for all Ilf sentences simultaneously. 

Remark 6.14 Theorem 6.12 is also signiflcant because it explains how its specialized 
logics can grapple with a nf encoded Godel sentence U which asserts "There is no 
proof of me". This issue is challenging because routine constructions, such as [61] 's 
Theorem 7.2, demonstrate that no natural logic can verify statement (33)'s validity for 
all sentences * (on account of the well-known syllogism posed by U's Godel 

sentence). Theorem 6.12 constructs, however, a reply to this challenge. This is because 
its self-justifying systems do surprisingly prove, without difficulty the validity of (34) 's 
translated modification of (33) 's unobtainable n| styled variant of a reflection principle. 

Remark 6.15 We encourage the reader to examine the work of Beklemishev, Kreisel- 
Takeuti and Verbrugge-Visser [5, 6, 7, 24, 52, 56] to see alternative reflection principles 
and their uses. (The constraint on proof-length, by Verbrugge-Visser, is certainly one 
alternative to Theorem 6.12's machinery. Likewise, Kreisel-Takeuti's Second Order Logic 
CFA reflection is another alternative, although it will not generalize to flrst-order log- 
ics.) One complicating aspect of our Theorem 6.12's reflection method is that Appendix 
E proves it becomes inoperable when an axiom system is sufficiently conventional to sat- 
isfy Godel's Second Incompleteness Theorem. In essence, Theorem 6.12's translational 

^'"'Sinco 5* and arc equivalent under the Standard-M Model but not also equivalent from the 

perspective of the system a = +SelfCons^(i?^ ), the conventional contradictions, produced by 
(33) 's reflection principle, disappear when it is replaced by (34). (Thus, there is no danger that a could 
use (34) 's reflection principle to prove an analog of U's forbidden Godel sentence.) 



^^Kreisel-Takeuti indicate on page 25 of [24] that CPA's reflection principle for a first order formula 
"A" infers the validity of only the relativized formula " A'^ " from A's proof. Also, their proof predicate 
is similarity relativized. Thus CPA's second-order logic reflection principle, while fascinating, does not 
generalize to first-order logic environments. 
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reflection principle is a specialized methodology, intended for logics using Definition 5.7's 
Level(l) style of self-justification. 

Remark 6.16 The preceding discussion clearly shows self-justifying logics are tempt- 
ing. At the same time, it is necessary to be very cautious because there are also two 
fundamental barriers limiting such results: 

a The first is the Theorem 2.1 arising from the joint work of Pudlak, Solovay, Nel- 
son and Wilkie-Paris [26, 33, 44, 58]. It showed no reasonable system recognizing 
successor as a total function can verify its own Hilbert consistency. Also, Willard 
[62, 67] established analogous results under semantic tableaux consistency for sys- 
tems recognizing multiplication as a total function. Thus, each effort to evade the 
Second Incompleteness Theorem must encounter robust barriers. 

b A second issue is that Definition 5.7's "SelfCons" "/ am consistent" axiom sentence is 
less than ideal because it causes axiom systems to produce essentially a 1-line proof 
of their own consistency. Such an excessively compressed proof corresponds more 
closely to an axiom system formulating an instinctive faith in its own consistency 
(rather than it supporting a full-length proof-justification of this fact). 

Part of the reason self-justifying systems are of interest, despite these limitations, is that 
they illustrate how some formalisms are compatible with at least an instinctive faith in 
their own self-consistency. (This compatibility issue is non-trivial because Item (a) im- 
plies there are many circumstances where a generalization of the Second Incompleteness 
Theorem will make it infeasiblc for a formalism to satisfy both Parts (i) and (ii) of Sec- 
tion I's definition of Self- Justification.) Moreover, three of Appendix D's four sample 
self-justifying configurations, called ^* , ^** and , will be Type-A systems that rec- 
ognize addition as a total function. These configurations will thus possess the following 
three significant finitized features: 

1. They will be able to construct the entire infinite set of integers by finite means 
because they recognize addition as a total function. 

2. For any r.e. logical configuration {B,T>), it will be possible to develop a 1-sentence 
finitized extension for the base axiom systems of any of the configurations of ^* , 
^** and , which deploy (28) 's Global Simulation Sentence to simulate the 

knowledge of (B,!)). This means that some fully finite-sized extensions of the 
base-formalisms of ^* , ^** and will contain a non-trivial amount of 11^ 
styled knowledge, since {B,T>) can correspond to, say, Peano Arithmetic. 

3. The key point is that a 1-sentence extension of an axiom system containing features 
(1) and (2) can formalize how a logic can possess an instinctive faith in its own 
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consistency via Theorem 6.10's explicitly finitized structure. (Moreover, Theorem 
6.12's Translational Reflection Principle is applicable to Appendix D's generic con- 
figurations of ^* and ^** . It will thus imply that their single finitized Level-1 
self-justifying axioms enable them to prove an infinite number of incarnations of 
(34) 's translational reflection principle, where each 11^ sentence \1' is mapped onto 
one such unique instance.) 

The contrast between Items 1-3's positive remarks about "finitized" cogitation with 

Items (a) and (b)'s opposing comments is obviously formidable. It is clearly preferable 
to view these positive results cautiously and treat them as being no more than boundary- 
case exceptions to the Second Incompleteness Theorem. The essential reason why these 
exceptions are of interest is that Godel's famous centennial paper has implicitly raised 
the following puzzling issue: 

# How is it that Human Beings manage to muster the physical drive to 
think (and prove theorems) when the many generalizations of Godel's Second 
Incompleteness Theorem assert conventional logics lack knowledge of their 
own consistency? 

There will, of course, never be any perfect answer to the puzzle posed by # because 
philosophical paradoxes and ironical dilemmas never yield perfect answers. However, 
part of an imperfect answer to # is that Items 1-3 reply to Challenges (a) and (b) by 
formalizing how a thinking being can muster an approximate partial instinctive faith in its 
own self-consistency. (Moreover, the tight contrast between various generalizations of the 
Second Incompleteness Theorem [1, 3, 8, 10, 15, 16, 21, 25, 33, 37, 44, 46, 58, 62, 63, 67] 
with the self-justifying systems appearing in Appendixes D and G suggests that these 
come close to being maximal forms of feasible results.) 

Our remaining discussion will consist of four optional sections, called Appendixes D, 
E, F and G, which can be skimmed, omitted or examined in any order the reader prefers. 
A summary of their contents is given below: 

I The Appendix D provides four examples of generic configurations that utilize The- 

orems 5.9, 5.11, 6.3, 6.6 and 6.10. Its most prominent examples involve Equa- 
tion (2)'s Type- A axiom systems where the deduction method is either semantic 
tableaux or a modified version of tableaux that permits a modus ponens rule for 
nf and Sf sentences. 

II The Appendix E introduces a generalization of the Second Incompleteness Theorem 
which shows that Theorem 6.12's Translational Reflection Principle applies only to 
self-justifying logics. (It is thus fully inoperative for conventional logics. This may 
explain why Theorem 6.12's self-justifying systems are an interesting topic.) 
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III The Appendix F differs from the rest of this paper by having a philosophical slant. 
It will offer a 3-page summary about why we suspect Theorem 6.3's self-justification 
formalism and Remark 6.16's notion of "instinctive faith" are useful. 

IV The Appendix G introduces a "Braced^($, j)" construct and two new theorems 
that hybridize the methodologies of Theorems 6.6 and 6.10. These results will 
improve upon Theorem 6.6 because their self-justifying systems contain only a 
finite number of axiom-sentences beyond those lying in ^ 's base formalism of 
B^. They will improve upon Theorem 6.10 because they can prove the important 
Braced^(<I>, j) subset of (;B,P)'s theorems in a full sense (rather than in Re- 
mark 6.9's weaker simulated respect). Appendix G's results are useful because for 
arbitrary k and for any of Appendix D's four sample configurations, every Ilf the- 
orem of {B,V) containing k or fewer bounded and unbounded quantifiers will be 
proven by its Theorem G.3 to be self-justifying in an undiluted pure sense. (This 
is because each such 11^ sentence, with fewer than k quantifiers, will lie in some 
fixed Braced^ ($,j) set — where solely the value of k determines the values for 
$ and j . ) 

It is probably desirable to concentrate primarily on Theorems 5.9, 5.11, 6.3, 6.6, 6.10 
and 6.12 during one's first reading of this paper. This is because Appendixes A-G are 
less central than these core theorems, although their material does add several useful 
further perspectives to this subject. 

7. Concluding Remarks 

The research in this article has been a continuation of our prior research [59]- [68] that 
simultaneously has simplified, unified and extended the prior results. It has explored 
self-justification with a 3-part approach where: 

1. Sections 4 and 5 introduced three different stem components that can be used to 
generate self-justifying systems. (These are the relatively simple Lemma 4.6 and 
the mathematically more sophisticated Theorems 5.9 and 5.11.) 

2. Section 6 and Appendix G then generalized our initial stem-like theorems in the 
six different directions formalized by Theorem 6.3, 6.6, 6.10, 6.12, G.2 and G.3 

3. Appendix D subsequently provided four examples of generic configurations that 
are applications of Section 6's results. 

This 3-part approach is very different from the methods used in our prior articles [59, 64, 
66, 68]. The latter examined particular isolated applications in thorough detail (rather 
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than compartmentalize and separate the analysis into three stages). The virtue of this 
3-stage analysis is it leads to many new theorems, in addition to unifying our prior 
results. 

It is desirable to categorize the maximal generality and strongest form of boundary- 
case exceptions for the Second Incompleteness Theorem that arc feasible because Godel's 
centennial discovery beckons the scholarly community to sharpen their understanding of 
his 1931 landmark discovery, that has fundamentally reshaped mathematics. 

It should be emphasized that our over-all research in [59] - [68] has spent an approx- 
imately equal effort in exploring generalizations of the Second Incompleteness Theorem 
[62, 63, 66, 67] and in examining its viable boundary-case exceptions [59, 61, 64, 65, 66, 68] 
(although the current article focused on the latter topic). This is because the Second 
Incompleteness Theorem is a starkly robust result that imposes sharp limits on how 
strong self-justifying systems may become. 

Finally, we encourage the reader to take another brief glance at Remarks 6.13 - 6.16. 
They offer a brief summary of both the strengths and limitations of our chief results. 
They also explain how Theorem 6.12's reflection principle for Ilf styled theorems is a 
very unexpected result. 
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Appendix A: The Ilf encoding for SelfCons'^(y5, d) 

This appendix will summarize how to formalize a 11^ encoding for Definition 5.7's 
SelfCons''(/3, d) predicate. It will use the following notation: 

1. Neg^{x,y), will denote a Aq formula indicating that x is the Godel number of a 
n| sentence and that y represents the e| sentence which is its logical negation. 

2. Prf^ {t , p) will denote a formula designating that p is a proof of theorem t 
from the axiom system j5 using the deduction method d. 

3. ExPrf^ (/i, t , p) will denote that p is a proof (using d's deduction method) of a 
theorem t from the union of the axiom system /3 with the added sentence whose 
Godel number equals h . 

4. Subst {g , h) will denote Godel's substitution formula — which yields TRUE when 
g is an encoding of a formula and h encodes a sentence that replaces all occurrence 
of free variables in g with a term of g (that specifies ^'s Godel number). 

5. SubstPrf ^ {g : t , p) will denote the hybridization of Items 3 and 4 that yields a 
Boolean value of TRUE when there exists an integer h satisfying Subst {g , h) 
and ExPrf^ {h,t,p). 

It is easy to apply [61] 's methodologies to confirm Items 1-5 can be encoded as 
Aq formulae. Thus, Appendixes C and D of [61] explained how the theory of LinH 
functions [15, 23, 69] implied there existed Aq encodings for formulae 1-4, and these 
Aq encodings can be easily rewritten ^'^ as Aq expressions. Equation (35) uses this 
information to formulate a Aq encoding for SubstPrf'^g {g,t,pys graph. It is equivalent 
to " 3 /i { Suhst{g,h) A ExPiij{h,t,p)} ", but Equation (35) is written in a A^ 
format — unlike the quoted expression. 

PTij{t,p) V 3 h<p {Suhst{g, h) A E^Prfj {h,t,p)} (35) 

Using (35)'s Aq encoding for SubstPrf^(^, f,p), it is easy to encode SelfCons'^(/3, d) 
as a axiom-sentence. Thus, let T^{g) denote (36)'s formula, and let n denote r(g')'s 
Godel number. 

'ix'iy'ip'iq ^ {Neg*^(x,y) A SubstPrf^ (5, x,p) A SubstPrf ^ (3, ?/, g) } (36) 

Then " r'^( n ) " is a Jl\ encoding for SelfCons'^(/3, (i)'s formalization of the statement 
-I- from Definition 5.7. Thus, r'^( n ) is encoded is as follows: 

Vx-VyVpVg ^ {Neg*^(x,y) A SubstPrf)^ (n, x,p) A SubstPrf (n, y, g) } (37) 

^''This rewriting of conventional Aq formulae into a Aq format is possible because Part 2 of Defini- 
tion 3.4 indicated that two 3-way predicates of Add(x,j/, «) and Mvli{x,y, z) do encode addition and 
multiplication in a A^ styled form. 
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Reminder about Equation (37) : This sentence's definition for SelfCons'''(/3, d) 
does not assure (37) is true under tire Standard-M model. Indeed for nearly all {f3,d), 
it will be false when k > 2. This is the reason that the study of SelfCons'^'(/5, d), under 
Theorems 5.9 and 5.11, has focused on the cases where k equals or 1. Moreover, the 
preceding construction did assure that SelfCons'^(/3, d) had a Il\ encoding because such 
an "/ am consistent" axiom carries more meaning than a encoded axiom. 

Appendix B: The Proof of Lemma 6.1 

Lemma 6.1 is a crucial interim step used to verify each of Theorems 6.3, 6.6 and 6.10. 
Its proof will employ the following three straightforward observations: 

Fact B.l Lemma 6.rs hypothesis implies that ^* is a generic configuration. (This is 
because it specified that ^ was a generic configuration and that all the uf sentences 
of 9* were true in the Standard-M model. Thus, ^* must also be a generic 
configuration.) 

Fact B.2 The associative identity oi OU {9* UB^) = {9ue')\JB^ obviously holds. 
It implies a sentence T is a theorem of U {6* U B^) if and only if it is a theorem 
of {9U e*)UB^. 

Fact B.3 Lemma 6.1's hypothesis directly ^® implies tj( 9) = 9* U 9). 

The justification of claims (i)-(iv) are consequences of Facts B.l through B.3. We 
will provide a detailed proof of only Claim (i) here because all four claims have similar 
proofs. 

Proof of Claim (i) : The hypothesis of Claim (i) indicated that ^ was 0-stable. 
Therefore, it satisfies Definition 5.10's invariant of * * * . In a context where ^ is a 
variable designating a r.e. set of nf sentences and T is a variable corresponding to a 
Aq sentence, the invariant * * * can be rewritten in a quasi-rigorous form as : 

V ^ V T the below statement, called ^i(^, T), is true (38) 

V p If T is a Aq theorem derived from the axiom system cf) U B^ via a 
proof p, whose length satisfies Log(p) < (f)) +1, then T is true under 
the Standard-M model. 

Since (38) 's universally quantified variable (f) can designate any r.e. set of Ilf sentences, 
it may designate the object "9 U 9* " , where 9* is the r.e. set of 11^ sentences defined 

'^^The identity of tt( ) = oo must be true because the hypothesis of Lemma 6.1 indicated 
that all the IIj sentences in 6* are true under the Standard-M model. By Definition 4.4, this implies 
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by Lemma 6.1's hypothesis (and is any second r.e. set of sentences). Thus, (38) 
directly imphes : 

VT the below statement, called ^'2(0, T), is true (39) 

V p If T is a Ag theorem derived from the axiom system { 6 U 6* ) U 
via a proof p , whose length satisfies Log(fj) < t|( 9L) 6*) +1, then T is 
true under Standard-M. 

Facts B.2 and B.3 enable one to simplify (39) 's terms of ( 6* U ) UB^ and ji( ( 6" U 6'' ) ) 
and thus to derive (40) as a consequence. 

y 6 VT the below statement, called "^3(6, T), is true (40) 

V p If T is a Aq theorem derived from axiom system 9 U { 6* U ) via 
a proof p, whose length satisfies Log(p) < tt( 0) + 1, then T is true under 
the Standard-M model. 

We will now use Fact B.l's observation that ^* is a generic configuration. The sentence 
(40) indicates this configuration satisfies Definition 5.10's invariant of * * *. Hence, ^* is 
0-stable. □ 

Brief Comments about the Justifications of Claims (ii)-(iv): This appendix 
has omitted proving (ii)-(iv) for the sake of brevity. Their proofs are similar to Claim 
(i)'s proof. For instance. Claim (ii)'s proof differs from Claim (i)'s proof by having the 
0-stability invariant in * * * replaced by the A-stability invariant of * . This will cause 
the analogs of (38) - (40) to undergo the following two simple changes under Claim (ii)'s 
proof : 

1. T will represent a 11^ (rather than a Aq ) theorem-statement under the revised 
versions of *2 and ^3 used in Claim (ii)'s proof 

2. The requirement (in sentences (38)-(40) of Claim i's proof) that T be true in the 
Standard model is changed to the stipulation that T satisfies the Good{ ^ tJ( } 
and Good{ ^ tt( ^)} conditions under the revised forms of ^1, *2 and ^'3 used to 
prove Claim (ii). 

Other minor adjustments in Claim (i)'s proof shall verify Claims iii and iv. 
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Appendix C: The Proof of Theorem 5.11 



Our proof of Theorem 5.11 is a straightforward modification of Theorem 5.9's proof. It 
will be divided into two lemmas. 

Lemma C.l. Every generic configuration that is either E-stable or A-stable will 
automatically satisfy Definition 5.10's 0-stability condition. 

Proof. Lemma C.l is a consequence of the "Special Note" appearing at the end 
of Definition 4.2. For every > 0, it indicated that if T is a Ag sentence then 
Scope£;(T, A^) is equivalent to T . This implies (via Definition 4.3) that if T is a 
Good(N) Aq formula then Scope£;(T, A^) is automatically true under the Standard-M 
model. 

The latter observation makes it easy to confirm Lemma C.l. This is because every 
Aq sentence is a nf and nf statement. Hence, the application of the invariants * 
and * * from Definitions 5.1 and 5.3, in the degenerate case where T is a Aq theorem, 
corroborates Lemma C.l's claim (by showing that Definition 5.10's invariant of * * * 
does hold). □ 

The remainder of this appendix will focus on Definition 5.10's 0-stability condition. 
(This is sufficient to justify Theorem 5.11 because Lemma C.l showed all E-stable and 
A-stable configurations are 0-stable.) 

Lemma C.2. Let ^ denote a generic configuration {L^, A^, B^,d,G) that is 0- 
Stable. Then the axiom system of B^+SelfCons^{B^,d) will be consistent (and hence 
self-justifying). 

Proof: It will be awkward to write repeatedly the expression " B^-|-SelfCons°(B^, d) " 
during our proof. Therefore, H will be an abbreviated name for this system. Our justi- 
fication of Lemma C.2, is similar to Theorem 5.9's proof, except it replaces a Level(l^) 
form of self-justification with a Level(O^). It will thus be abbreviated and use the fol- 
lowing notation: 

1. Prfij(t,p) is a Aq formula specifying p is a proof of the theorem t from the 
axiom system H (using ^ 's deduction method oi d). 

2. Neg'^(,x,y) is a Aq formula indicating x is the Godel encoding of a Aq sentence 
and y is a Aq sentence representing x 's negation. 

Expression (41) denotes i^'s Level(O^) self-justification axiom. It is encoded using 
Appendix A's methodology, similar to its counterpart used in Theorem 5.9's proof (i.e. 
Equation (21) ). 

VxVyVpVg - {Neg°(x,y) A PvfH{x,p) A PviH{y,q)} (41) 
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Our proof of Lemma C.2 will be a proof by contradiction. It will thus begin with the 
contrary assumption that H is inconsistent and have <1> denote (41) 's sentence. The 
inconsistency of H implies that $ is false under the Standard-M model. Hence via 
Definition 4.4, we get: 

< oo (42) 

Equation (42) implies there exists a tuple (p, q, x, y) satisfying (43). (This is because such 
a {p,q,x,y) corroborates (42) 's implication that a counter-example to (41) 's sentence 
does exist.) 

Neg°( X , y) A Piin {x , p) A Frfn {y , q) (43) 

The {p, q, x, y) satisfying (43) with minimum value for Log{ Max[p, q, x, y] } will addition- 
ally satisfy (44). (This observation follows from the analog of the Footnote 10 appearing 
in Theorem 5.9's proof. Thus, Section 5's Equations of (23) and (24) are the analogs of 
the current Equations (43) and (44). The Footnote 10 showed the particular {p,q,x,y) 
satisfying (23) with minimum value for Log{ Max|j3, g, x, y] } satisfied (24). By the same 
reasoning, the minimal {p,q,x,y) satisfying (43) will satisfy (44).) 

Log { Max[ p, q , X , y] } = tt($) + l (44) 

Equations (43) and (44) shall bring Lemma C.2's proof-by-contradiction to its sought- 
after end. Thus, let T denote the Aq sentence specified by x . Then -i T corresponds 
to the Aq sentence denoted by y . Equation (44) indicates that both T and -> T have 
proofs such that the logarithms of their Godel numbers are bounded by tt( $ ) -|- 1 . 
Using Definition 5.10's invariant of * * * , these facts establish that both T and 
-1 T are true under the Standard-M model. 

But it is impossible for a sentence and its negation to be both true. This finishes 
Lemma C.2's proof because the temporary assumption that H was inconsistent has led 
to a contradiction. □ 

Theorem 5.11 is a consequence of the Lemmas C.l and C.2 because Lemma C.2's for- 
malism generalizes to all E-stable and A-stable configurations via Lemma C.l's reduction 
methodology. 



^''To apply Definition 5.10's invariant * * * in the present setting, one simply sets 9 's R-View equal 
to <E> 's 1-sentence statement. Then * * * impUes that both T and -■ T must be true under the 
Standard-M model because both their proofs had lengths < tt( ^ ) + 1 • 
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Appendix D: Applications and Examples 



This appendix will illustrate four examples of generic configurations that satisfy Theo- 
rems 5.9 and 5.11 (and which therefore are self-justifying). It will be divided into three 
parts. Section D-1 will define our first example of self-justifying configuration, called . 
It will use semantic tableaux deduction. Section D-2 will prove that ^* is EA-stable. 
Section D-3 will briefly sketch three additional examples of stable generic configurations 
It is likely preferable to examine Sections 3-6 before this appendix. However, Section 
D-l's short 2-page discussion can be read quite easily either before or after Section 6. 

D-1. Definition of the EA-Stable Configuration ^* 

Our first example of an EA-Stable configuration, called ^* , will be defined in this section. 
Its deduction method will be semantic tableaux. Its base axiom system B* will be a 
Typc-A formalism, which treats addition but not multiplication as a total function (i.e. 
see Equation (2) ). 

The closest analog of B* and ^* in our prior work appeared in Section 5 of [64] . (It 
differed from ^* partly because it did not use Definition 3.4's unifying notation.) In [64], 
a function F was called Non-Growth iff F(ai, 02, ...Oj) < Maximum{ai,a2, ■■■aj) for 
all ai,a2, ...aj. Six examples of non-growth functions are: 

1 . Integer Subtraction where " x — y " is defined to equal zero in the special case where 
X <y, 

2. Integer Division where " a; y " equals x when y = 0, and it equals [ x/y \ 
otherwise, 

3. Root{x,y) which equals \ x^^'^ ] when y>l, and it equals x when y = 0. 

4. Maximum{x,y), 

5. Logarithm{x) = [ Log2(a:;) J when x >2, and zero otherwise. 

6. Count{x,j) = the number of "1" bits among x's rightmost j bits. 

These operations were called Grounding Functions in [64]. The term U-Grounding 

Function referred to a set of functions that included the Grounding operations plus the 
further primitives of addition and Double{x) = x + x. (The Double operation is helpful 
because it significantly enhances [64] 's linguistic efficiency .) 

The symbol Aq will be the analog of Definition 3.1's Ag construct under the U- 
Grounding function language. (It will be defined to be any formula in a U-Grounding 

^°The symbol Double(x) was technically unnecessary in [64] 's formalism because x + x can encode 
Doublc(x). However, its notation adds expressive power to [64] 's language because, for example, Dou- 
ble (Double (Double (Double (x))) requires less memory space to encode than than x added to itself 16 
times. 
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language where all its quantifiers are bounded.) It is easy in this context to encode a 
Aq formula Mult{x, y, z) for representing multiplication's graph. For instance, Equation 
(45) is one such Aq formula (which actually does not employ any bounded quantifiers): 

[(a; = OVy = 0)^z = 0] A [ {x ^ Q ^y ^ Q ) ^ { ^ = y ^ <V )] (45) 

Expression (45) is significant because Part 2 of Definition 3.4 indicated every generic 
configuration must have available some method to represent the graphs of addition and 
multiplication in a Aq styled format, similar to (45) 's paradigm. (Addition can be treated 
trivially because the U-grounding language possesses an addition function symbol.) The 
footnote "^^ serves as a reminder about why these Aq encodings are needed. Our next 
goal is to define the generic configuration ^* that Section D-2 will prove is EA-stable. 

Definition D.l. The language L* of the generic configuration ^* will be built in 
a natural manner out of the eight U-grounding function operations, the usual atomic 
predicate symbols of " = " and " < ", and the three constant symbols Kq, Ki and 
K2 (that define the integers of 0, 1 and 2). The other components of ^* 's configuration 
are defined below: 

i As previously noted, Aq is defined to represent the set of all formulae in L* 's lan- 

guage, whose quantifiers are bounded in an arbitrary manner by terms employing 
the U-Grounding function symbols. (It will thus generate via Definition 3.1 the 
n* and S* sentences of L* .) 

ii The base axiom system B* for ^* will be allowed to be any consistent set of 11^ 

sentences that is capable of proving every Aq sentence that is valid in Standard- 
M. It will also include sentence (46) 's very precise 11^ styled declaration that 
addition is a total function. 

Va; My 3 z <x + y : { z = x + y } (46) 

iii ^* 's deduction method will be the semantic tableaux method. 

iv ^* ' s Godelized method g for encoding a semantic tableaux proof can be essentially 
any natural method that satisfies the minor stipulation that at least 5 J bits are 
required to encode a semantic tableaux proof that has J function symbols. This 

Section 3 explained during its discussion of Lemma 3.6 that every generic configuration ^ must have 
a means to encode the graphs of addition and multiplication as Aq formulae (visavis Parts 1 and 2 of 
Definition 3.4). This enabled Lemma 3.6's procedure to translate all of conventional arithmetic's Ej and 
formulae into equivalent Ej and n| expressions. 



The two appearances of the term " a; + j/ " in sentence (46) may at first appear to be redundant. 
(This statement is equivalent to sentence (4)'s declaration that addition is a total function, which had 
avoided such redundancy.) The virtue of (46) 's format is that it is a Hi styled statement, unlike (4)'s 
n| styled format. This sharpened 11* perspective will help simplify some of our proofs. 
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stipulation is called the "Conventional Tableaux Encoding Requirement". 

It is trivial to corroborate that all the usual methods for encoding semantic 
tableaux proofs satisfy this criteria. (The Appendix A of [64] provides one example 
of a possible tableaux encoding method. Any other natural mechanism for encoding 
tableaux proofs is equally suitable.) 

Section D-2 will, interestingly, prove that ^* is EA-stable. This will imply (via 
Theorem 5.9) that B* U SelfCons^{ B* ,d } is self-justifying. Theorems 6.6, 6.10, 
G.2 and G.3 will, formalize, in this context, four different methods in which B* can be 
extended to construct self-justifying formalisms that are able to prove Peano Arithmetic's 

theorems. 

Thus while self-justifying axiom systems contain unavoidable weaknesses, they also 
possess the nice feature that they are able to prove many of the useful theorems of 
mathematics. 

D-2. Proof of the EA-Stability of 

This section will prove ^* is EA-stable and thus satisfies the paradigms of Theorems 5.9, 
6.3, 6.6, 6.10 and 6.12. Our proof will be based on modifying some of the methodologies 
from [64], so that they become applicable to ^* . Many readers may prefer to omit ex- 
amining both this part of Appendix D and Section D-3 because they are unnecessary for 
understanding the material in Section 6 and Appendixes E and F. (Our recommendation 
is that the latter material be read first.) 

Our notation for defining a semantic tableaux proof in the next paragraph will be 
similar to the conventional definitions appearing in Fitting's and Smullyan's textbooks 
[12, 40]. It will employ [64] 's notation so that we can employ two of its lemmas during 
our analysis of semantic tableaux proofs. 

In our discussion, $ will be called a Prenex-Level( m* ) sentence iff it is a 11^ 
or SJI^ expression that satisfies the usual prenex requirement (that all its unbounded 
quantifiers lie in its leftmost part). If $ is Prenex-Level(m* ) then Reverse($) shall 
denote a second Prenex-Level( m* ) sentence that is equivalent to -> $ rewritten in 

^^The Conventional Tableaux Encoding Criteria requires that the Godel number of a semantic tableaux 
proof, with J function symbols, must be least as large as 32'^ . It is clear that all the usual methods for 
generating the Godel codes satisfy this criteria. This is because any proof that has J function symbols 
will contain at least 2 J logical symbols and thus employ at least 5 J bits. 



For example, if $ denotes " Va; 3y ip{x,y) " then Reverse($) would be written as 
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a Prenex Level(m* ) form. For a fixed axiom system a. its <I>-Based Candidate Tree 
will be defined to be a tree structure whose root is the sentence Reverse(<I>) and whose 
all other nodes are either axioms of a or deductions from higher nodes of the tree, via 
the rules 1-8 given below. (The symbol " A =^ B " in rules 1-8 will mean that B is 
a valid deduction from its ancestor A in the germane deduction tree.) 

1. TAT ^ T and TAT =^ V . 

2. ^^T =^ T. Other rules for the "-i" symbol are: ^(T V T) =^ A ^F, 
^(T^r)^TA-r, ^(TAT) ^ ^TV-r, ^^vT{y) ^ 'iv^T{v) 
and -iVvT(v) =^ 3'y-iT(w) 

3. A pair of sibling nodes T and F is allowed when their ancestor is T V F. 

4. A pair of sibling nodes -iT and F is allowed when their ancestor is T ^ F. 

5. 3vT{y) =^ ^iy) where u is a newly introduced "Parameter Symbol". 

6. 3v < s =^ u < s A T(n) is the variation of Rule 5 for bounded 
existential quantifiers of the form " 3u < s " . 

7. VwT(v) ^> T{t) where t denotes a U-Grounded term. These terms may be 
any one of a constant symbol, a parameter symbol (defined by a prior application 
of Rules 5 or 6 to some some ancestor of the current node), or a U- Grounding 
function-symbol with recursively defined inputs. 

8. < s T{v) =^ i < s — )■ T(t) is the variation of Rule 7 for a bounded quantifier 
such as " Vf < s " 

Let us say a leaf-to-root branch (in a candidate tree) is Closed iff it contains both some 
sentence T and its negation Then a Semantic Tableaux Proof of ^, from 

the axiom system a, is defined to be a $-Based Candidate Tree whose every leaf-to-root 
branch is closed. 

It is next helpful to define the notion of a Z-Based Deduction Tree, in a context 
where Z represents an axiom system, typically different from the prior paragraph's a . 
This object will be defined to be identical to a semantic tableaux proof, except for the 
following changes: 

i Every node in a Z— Based deduction tree must be cither an axiom of Z or a deduction 
from a higher node of the tree via the rules 1-8. (This applies also to the root of a 
.Z— Based deduction tree. It will store an axiom of Z in its root, unlike a semantic 
tableaux proof which had stored Reverse($) in its root.) 
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ii There will be no requirement that each leaf-to-root branch be closed in a 2^— Based 
deduction tree. (Indeed, some branch will automatically not be closed if Z is 
consistent.) 

Items (i) and (ii) make it apparent that Z— Based deduction trees are different from 
semantic tableaux proofs. It will turn out, nevertheless, that the study of Z— Based 
deduction trees will clarify the nature of semantic tableaux proofs. 

Definition D.2. Let a and 6 denote two integers that arc powers of 2 satisfying 
a > h > 2 Then an axiom system Z (employing L* 's language) will be called a 
Normed(a,b) formalism iff: 

1. All Z's axioms are either n| or S| sentences. 

2. Each axiom of Z will satisfy Definition 4.3's Good( Log2a ) criteria, and each 

axiom of Z will likewise satisfy Good( Log26 ). 

Clarification about Definition D.2 : The "Normed(a,b)" concept (above) 
is obviously equivalent to the same-named notion appearing in Definition 4 of [64]. 
It uses, however, a different notation to make it compatible with Section 4's formal- 
ism. Thus, Item 2's assertion that the n| axiom Vt;i Vf2 ...Vf^ (p{vi,V2, ...Vk) satis- 
fies Good( Log2a ) is equivalent to (47) 's statement. The Good(Log25) property of 
3vi3v2 ... 3 Vk 4>{vi,V2, ■■■Vk) is, likewise, equivalent to (48). 



\l vi < a \/ V2 < a ...V Vk < a 



(f>{vi,V2,...Vk) . 



(47) 



3 vi < b 3 V2 < b ...3 Vk < b 



(j){vi,V2,...Vk) 



(48) 



Our interests in this notation will center around Fact D.3's invariant: 
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Fact D.3 . Let ^* denote Definition D.l's generic configuration, and Z be an ex- 
tension of ^* 's base axiom system B* wliich satisfies Definition D.2's Normcd(a, 6) con- 
straint. Tlien any Z— Based deduction tree Tthat has a Godel number smaller than 
must contain at least one root-to-leaf branch, called a , that is not "closed". (In 
other words, this path a will be contradiction-free, insofar as it does not contain both 
some sentence ^ and its formal negation). 

Proof: The justification of Fact D.3 is a direct consequence of the Lemmas 1 and 
2 appearing in article [64] (see footnote for more details). □ 



A proof of Fact D.3 from first principles would be quite complicated because there are eight elimi- 
nation rules employed by semantic tableaux deduction, each of which needs to be examined by such a 
proof's umbrella formalism. Fortunately, we do not need provide such a complicated analysis here be- 
cause a 4-page proof of the Lemmas 1 and 2 in Section 5.2 of [64] had already visited these issues. Thus, 
Fact D.3 turns out to be an easy consequence of these two lemmas after the following two straightforward 
issues are addressed: 

1. Section 5.2 of [64] had defined the "U-Height" of a deduction tree to be the largest number of 
U-Grounding function symbols that appear in any of its root-to-leaf branches. Its Lemma 1 proved 
that every deduction tree with a U-Height < Log2a — Log^h will contain at least one branch 
satisfying a condition, which [64] called "Positive(a,b)" . The Lemma 2 in [64] then showed that 
this Positive(a,b) property implies that the germane deduction tree must contain some branch 
that is contradiction-free. The combination of these two lemmas thus amounts to the establishing 
of the following rephrased hybridized statement: 

• If a Z-bascd deduction tree has a U-Height < Log-za — Log-zb , then some branch 
of it is contradiction-free (i.e. this branch cannot contain both some sentence VP and 
its negation). 

2. Fact D.3 's hypothesis indicated the Godel number g for its deduction tree satisfied the following 
conditions: 

I. g < (a/bf 

II. The U-Height of g 's deduction tree is less than i Log2 g ■ (This is simply because Fact 
D.3 presumes that the "Conventional Tableaux Encoding" methodology from Part-iv of 
Definition D.l was used to encode g's Godel number.) 

Items I and II imply g's tree has a U-Height < Log2a — Log2b. The invariant • then implies 
this deduction tree has at least one branch that is contradiction-free (as Fact D.3 claimed). □ 

We emphasize that the above justification of Fact D.3 is much simpler than a proof from first principles. 
The latter would require examining eight different tableaux elimination rules, as the detailed proofs of 
[64] 's Lemmas 1 and 2 actually did do. 
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We will now apply Fact D.3 to prove Theorem D.4. Its invariant will, interestingly, 
collapse entirely if one were to merely add a multiplication function symbol to the U- 
Grounding language. This is why our boundary-case exceptions to the semantic tableaux 
version of the Second Incompleteness allow a Type-A axiom system to recognize addition 
as a total function (but suppress a similar treatment of multiplication). 

Theorem D.4. The generic configuration ^* is both A-stable and E-stable. (This 
implies many different self-justifying formalisms exist via Theorems 5.9, 6.3, 6.6, 6.10, 
6.12, G.2 and G.3.) 

Our proof of Theorem D.4 will separately show ^* is A-stable and E-stable. 

Proof of ^* 's A-stability : Suppose for the sake of establishing a proof by con- 
tradiction that S^* was not A-stablc. Then the constraint * of Definition 5.1 would be 
violated by at least some 9 GRE-Class(^). This violation will cause the statement + 
to be true for such a 9 : 

+ There exists a semantic tableaux proof p of a 11* theorem, called say T , from 
the axiom system of 9U such that Log(p) < tt( 0) -|- 1 and where T also 
fails to satisfy Good{ i tJ( ^) } • 

Let us recall that if T is n| then Reverse( T ) is a S| sentence equivalent to -iT . Thus, 
Reverse(T ) will satisfy Good{ ^ tt( ^) } criteria (simply because it has the opposite 
goodness property as T ). Also, if Z denotes the axiom system of 0US^ -|- Reverse( T ), 
it is easy to verify that Z 's axioms will satisfy the Normed{ 2 ^) , V 2 f( ^) } criteria. 

It is next helpful to observe that what is a proof from one perspective corresponds 
to being a deduction tree from a different perspective. Thus, Item + 's proof p of the 

The difficulty posed by multiplication can be easily understood when one compares two integers 
sequences xo,xi,X2, ■■■ and j/o,J/i,2/2, defined as follows: 

Xi = Xi-i + Xi-i AND j/i = j/i-i * j/i-i 

It turns out that the faster growth rate of multiplication under the series j/o, 2/i, 2/2, ••• enables one to 

to construct tiny Z— Based deduction trees T that violate the analog of Fact D.3 's paradigm. (This is 
because such trees can have Godel numbers smaller than (a/6)* , while all their root-to- leaf branches can 
be simultaneously "closed" via contradictions.) This property of multiplication is analogous to Example 

3.7's observations about how the difl'cring growth rates of xo,xi,X2, ... and j/o, j/i , ^2, ■•■ arc related to the 
threshold where the semantic tableaux version of Second Incompleteness Theorem can be evaded. 

The axiom system Z must satisfy Normed{ 2 *^ , V 2 } because: 

1. The quantity 2 is a valid first component for Z's norming constraint because all the axioms 
of are true in the Standard-M model and because Definition 4.4 implies all of 6 's axioms 
satisfy Good { 1(9)}. 

2. The quantity V 2 «( «) is a valid second component for Z's norming constraint because 
Reversc( T ) is the only sentence belonging to Z, and because Reverse( T ) satisfies 

Good{ i lie) } . 
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theorem T from the axiom system of 6U corresponds to being a Z-based deduction 
tree, with Z representing the axiom system of ^ U + Reverse( T ). In this context, 
Item + 's inequahty of Log(p) < ^{ 6 ) +1 impUcs that p , viewed as a deduction 
tree for Z , satisfies the hypothesis of Fact D.3 . Hence, Fact D.3 establishes that p 
must contain at least one contradiction-free root-to-leaf branch. 

This last observation is all that is needed to confirm 's A-stability, via a proof-by- 
contradiction. This is because the definition of a semantic tableaux proof implies every 
one of its root-to-leaf branches must end with a pair of contradicting nodes. However, 
the last paragraph showed p will not satisfy this required property, if ^* is not A-stable. 
Hence our construction has proven the A-stability of ^* by showing that otherwise an 
infeasible circumstance will arise. □ 

Proof of ^*'s E-stability : A proof- by-contradiction will verify ^* is E-stablc, 
analogous to the proof of its A-stability. Thus if ^* was not E-stablc, then statement 
-|— I- would be true for some 6. (This is because at least one 6 G RE-Class(^) would then 
violate Definition 5.3's requirement of * * .) 

H — h There exists a semantic tableaux proof p of a theorem T from the axiom sys- 
tem euB^ such that Log(p) < ^{9) + l and T also fails to satisfy Good{ ^ tt( 9) }. 

Item -I— I- implies Reverse(T) satisfies Good{ ^ tl( ^)} (because Reverse(T) again has 
the opposite goodness property as T ). Let Z now denote the formal axiom system of 
9UB^ + Reverse(T). The footnote then uses reasoning similar to footnote 27 to show 
Z satisfies Normed{ V 2 «( ^) , 2 } 

As before via a simple change in notation, p 's semantic tableaux proof of T can be 
viewed as a deduction tree using Z 's axioms. Also as before, we may use the combination 
of the facts that Z is a Normed{ V 2 ^) , 2 } system and that Item -|— |- indicated 
Log{p) < ji( 0) -I- 1 to deduce^° that p is small enough to satisfy Fact D.3 's hypothesis. 

Without loss of generality, we may assume that every non-trivial proof p satisfies Log(p) > 64 

(since a string with fewer than 64 bits is too short to be a proof). Then the footnoted paragraph's 
Log(p) < tt( ^) +1 inequahty trivially implies p < 3 . In a context where Z is a 

Normcd{ 2 ^ , V 2 ^( ® ' } axiom system, the latter inequality certainly implies p , viewed as a 
deduction tree for Z , has a small enough Godel number to satisfy the hypothesis for Fact D.3. (This is 
because if one sets o = 2 ^) and 6 = V2 «( ») then obviously p < 3 < 4 = {a/bf ). 

^^The axiom system Z must satisfy Normed{ V 2 "( ^) , 2 } because: 

1. The first component of its norming constraint can be set equal to V 2 because Reverse( T ) 
is a Good{ ^ tt( ^ ) } sentence, and all Z 's other IIi sentences satisfy more relaxed 
constraints. 

2. The second component of Z's norming constraint is satisfied by the constant of 2 because Definition 
D.2 implies this quantity is always permissible when Z contains no axiom sentences. 



'The proof that p is small enough to satisfy Fact D.3 's hypothesis in the current El-stable case is 
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Hence once again, Fact D.3 implies that Z must contain at least one contradiction-free 
root-to-lcaf branch. As before, the existence of this contradiction-free path violates the 
definition of a semantic tableaux proof and enables our proof-by-contradiction to reach 
its desired end. □ 

Remark D.5 (about Theorem D.4's significance) : Paxt-ii of Definition D.l indicated 

^* 's base axiom of B* was a Type-A formalism that recognized addition as a total 
function. This is significant because [60, 62, 67, 68] showed nearly all Type-M formalisms, 
including all the common axiomatizations for ISq, are unable to recognize their semantic 
tableaux consistency. Thus, the declaration that multiplication is a total function is the 
trigger-point causing the semantic tableaux version of the Second Incompleteness 
Theorem to become active. This threshold effect is significant because Theorem D.4, 
combined with Theorems 6.6, 6.10, G.2 and G.3, formalize four different respects in 
which Type-A self-justifying formalisms can prove all Peano Arithmetic's 11* theorems 
( a/ter multiplication's totality axiom is suppressed). 

D-3. Three Further Examples of Stable Generic Configurations 

Our second example of an EA-stable configuration is called ^** . It will be identical to 
^* except that it will replace semantic tableaux with a stronger deduction method, which 
[64] called Tah—U*. The latter is a revised version of semantic tableaux that permits a 
modus ponens rule to perform deductive cut operations on 11* and sentences. (The 
formal definition of Tab— C/* deduction had appeared in [64]. It will be unnecessary to 
repeat here.) 

The Section 5.3 of [64] noted Tab— has similar self-justification properties as 
conventional semantic tableaux. All the results that Section D-2 proved about ^* apply 
also to ^** , via their natural generalization under [64] 's Tab— C/^ deduction method. 
Thus, ^** is also EA-stable. 

A key point is that there is a non-trivial distinction between ^* and ^**, despite the 
fact that they have similar technical qualities. This is because ^** contains a Level- 1 
modus ponens rule (unlike ^* ). If it were infeasible to expand ^* into a broader ^**, 
then both formalisms could, perhaps, be easily dismissed as having negligible pragmatic 

almost identical to Footnote 28's analysis of the A-stable case. Thus as in the earlier case, Item ++'s 
inequality of Log(p) < tt( 6') +1 trivially implies p < 3 * ' . Also, we may again assume that 
Log(p) > 64 (since a sequence with fewer than 64 bits cannot amount to a proof of any interesting 
fact under all normal coding conventions). An analog of Footnote 28's chain of inequalities will then 
allow us to conclude that p is small enough proof from a Normed{ V 2 ^) , 2 } system to satisfy the 
hypothesis for Fact D.3. 



^^We formally proved in [60, 62, 67, 68] that multiplication's totality property causes the semantic 
tableaux version of the Second Incompleteness Theorem to become active. The Example 3.7 summarizes 
the main intuition behind these results. 
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significance (since modus ponens is central to cogitation). However in a context where 
^** does permit a Level-1 modus ponens rule, it is a tempting formalism (despite its 
limited modus ponens rule). 

Unlike ^* and , our third example of an EA-stable configuration, called ^~ , will 
support an unlimited modus ponens rule. This will be possible because S,^ 's language 
of L~ will be weaker than the languages of and . Thus L~ will include 
the six Grounding functions, but not the Growth functions of addition and doubling. It 
will thus treat addition and multiplication as 3-way atomic predicates, Add(x, y, z) and 
Mult(a:;,y, z), rather than as formal functions. 

This perspective enabled ^~ to support an evasion of the Second Incompleteness 
Theorem with an unlimited modus ponens rule present, in a context where the other 
four parts of its generic configuration are defined below: 

1. The class for ^~ will be built in an essentially natural manner from the 
Grounding function set. It will thus include all formulae in 's language, whose 
quantifiers are bounded in any arbitrary manner using the Grounding function 
primitives. 

2. The base axiom system B~ of ^~ will employ an infinite number of constant 
symbols, denoted as Ki, i^2, i^3, ••• where Ki = 1 and where i^i+i is a power of 2 
defined by the axiom of: 

Add( Ki, Ki, Ki^i ) (49) 

Thus, the combination of K\,K2.,Kz, ... with the Grounding function of subtrac- 
tion allows the language L~ to encode the value of any arbitrary natural number 
(as Part 1 of Definition 3.4 had required). Essentially, 's base axiom system of 
can be any consistent r.c. set of sentences that includes (49) 's axiom 

schema and is able to prove every Aq sentence which is valid in the Standard-M 
model. 

3. ^~ 's deduction method can be any version of a classic Hilbcrt-stylc proof method- 
ology. (Thus, it will include a modus ponens rule with no restrictions.) 

4. ^~ 's Godelization method can be essentially any natural technique. 

An interesting aspect of is it can be proven to be EA-stable via an analog of Section 
D-2's treatment of Thus, Theorem 6.6 implies every axiom system a, whose 
theorems hold true in the Standard-M model, can be mapped onto an extension of 's 
base axiom system that can recognize its own Hilbert consistency and prove a's 11^ 
theorems. Except for minor changes in notation, this result represents a new way of 
proving [66] 's Theorem 3. 
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The self-justifying features of ^** and are of interest primarily because the 
Second Incompleteness Theorem implies that they cannot be improved much further. 
This tight fit is summarized by Items 1-4. 

1. The Theorem 2.1 (due to the combined work of Nelson, Pudlak, Solovay and Wilkie- 
Paris [26, 33, 44, 58] ) implies no natural axiom system can prove Successor is a total 
function and recognize its own Hilbert consistency. This theorem thus explains why 
the presence of growth functions must be omitted from ^~ 's base axiom system of 
B-. 

2. Moreover, [66] proved ^~ 's method for evading the Second Incompleteness Theo- 
rem will collapse if one replaces Equation (49) 's "addition-based named sequence" 
of constant symbols Ki,K2,K3, ... with a faster growing "multiplicative conven- 
tion", where the constant symbols Ci,C2,Cs, ... are formally defined via (50) 's 
schema. 

Mult( d, d, Ci+i ) (50) 

Thus, [66] showed that there exists a sentence W (provable from Peano Arith- 
metic) such that no consistent system can simultaneously prove W, contain (50) 's 
axiom schema and prove the non-existence of proof of = 1 from itself. There 
is no space to prove it here, but a generalization of the Second Incompleteness 
Theorem implies the modification of ^~ that replaces (49) 's axiom schema with 
(50) 's schema is not even 0-stable. 

3. Similarly, [62, 67] proved that if ^* 's and ^** 's base axiom system of B* was 
strengthened to include the assumption that multiplication was a total function 
then [64] 's two semantic tableaux evasions of the Second Incompleteness Theorem 
would both collapse. 

4. Also, [63] proved that an analog of ^** 's evasion of the Second Incompleteness 
Theorem will collapse if its modus ponens rule was expanded to apply to either Eg 
or sentences. 

The Item 3 is especially interesting because [65] proved [64] 's evasion of the Second 
Incompleteness Theorem was compatible with its formalism recognizing an infinitized 
generalization of a computer's floating point multiplication as a total function. Thus 
while the semantic tableaux formalisms of ^* or ^** are provably unable [62, 67] to 
recognize integer multiplication as a total function, their relationship to floating point 
multiplication is more subtle. 

Our fourth example of an application of Section 6's theorems was stimulated by some 
insightful email we received from L. A. Kolodziejczyk [20] in 2005. It noted there existed 
a potential exponential gap between the lengths of semantic tableaux and Herbrand-style 
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proofs under some circumstances. Our earlier research [62] addressed a 1981 Paris- Wilkie 
open question [30] by generalizing some Adamowicz-Zbierski techniques [1, 3] to show 
a natural axiomatization of ISq satisfied the semantic tableaux version of the Second 
Incompleteness Theorem. In this context, Kolodziejczyk asked whether this would apply 
to all plausible axiomatizations for ISg ? 

We replied in [68] to Kolodziejczyk's stimulating question by distinguishing between 
Example 3.2's and Aq^ formulae and by using the Paris-Dimitracopoulos [28] transla- 
tion algorithm for Aq formulae. (The latter procedure was summarized earlier by Lemma 
3.6. It demonstrated how to map classic arithmetic's A^ formulae onto equivalent Aq^ 
formulae in the Standard-M model.) Our reply to Kolodziejczyk's question, thus, em- 
ployed this translation methodology to show that there existed an axiom system, called 
Ax-3, which proved the identical set of theorems as the more common Ax-1 and Ax-2 
encodings of ISq and which possessed the following pair of quite fascinating contrasting 
properties: 

A No consistent superset P of Ax-3's set of axioms is capable of proving its own 
semantic tableaux consistency [68]. 

B In contrast, if "Herb" denotes the next paragraph's Herbrand-styled deduction and 
if "SelfRef" denotes the sentence • from Section 1, then Ax3 + SelfRef( Ax-3, Herb) 
will be a self- justifying axiom system. 

The intuition behind [68] 's proof of Items A and B can be easily summarized if we 
define a "Herbrandized-style" proof of a theorem $ from an axiom system a as being 
an essentially 2-part structure where: 

1. Each of a's axioms and also the sentence are first written as Skolemized 
expressions. 

2. A propositional calculus proof is then used to show that some formal conjunction 
of instances of Item I's Skolemization schema has no satisfying truth assignment. 

Such a formalism is different from the definition of a semantic tableaux proof (appearing 
in for example Fitting's textbook [12] ). This is because the latter replaces the use of 
Skolemization in Items 1 and 2 with an existential quantifier elimination rule. It turns 
out that this distinction enables some semantic tableaux proofs to be exponentially more 
compressed than their Herbrandized counterparts, as Kolodziejczyk observed [20, 21]. 
This fact enabled [68] to prove that Herbrandized and semantic tableaux proofs have the 
divergent properties summarized by Items A and B. 

One reason Ax-3's evasion of the Second Incompleteness Theorem is of interest is 
that ISo supports many more generalizations of the Second Incompleteness Theorem 
than evasions of it. Thus, Willard [62, 67, 68] proved that the semantic tableaux version 
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of the Second Incompleteness Theorem was vahd for three different encodings of ISq, 
and Adamowicz, Salehi and Zbierski have discussed in great detail [1, 3, 37] various 
Herbrandizcd generalizations of the Second Incompleteness Theorem for particular en- 
codings of ISo and ISq + ^i- Moreover, an added facet of [68] 's Ax-3 encoding for ISo is 
that most automated theorem provers use a particular variant of the Resolution method 
that causes [68] 's unusual methodology to apply also to them 

The reason for our interest in [68] 's results is that it represents a fourth example where 
the meta-theorems from Sections 5 and 6 can be useful. Thus, the footnote summarizes 
how a fourth type of generic configuration, called , can be defined that both duplicates 
[68] 's main self-justification results under the above definition of Herb-deduction, as well 
as strengthens them. (In particular, meets Theorem 5.11's requirements, and self- 
justifying extensions of its Ax-3 system thus recognize their Level(O^) consistency.) 

The properties of our four generic configurations of ^* , ^** and ^~ are 

summarized by Table I. These configurations are listed in ascending order according to 
the strength of their deduction methods d . As their deduction methods increase in 
strength, these configurations have their ability reduced to recognize the totality of the 
addition and multiplication operations. 

is thus a Type Almost-M system that can prove multiplication is a total function 
(but which docs not contain Equation (5)'s totality statement as an axiom). On the other 
hand, uses a stronger Hilbcrt-stylcd deduction methodology, which is incompatible 
with treating the totality of addition or multiplication as either axioms or as derived 
theorems. 

^^The main theorems in [68] generalize for resolution because Resolution-based theorem provers employ 
skolemization analogously to Herbrand deduction. 



The discussion in [68] did not technically use Definition 5.3's machinery to establish there existed 
an extension of its "Ax-3" encoding for ISo that could recognize its own Herbrand consistency. Its 
formalism, however, could be easily couched in terms of Definition 5.3's machinery, if one uses a generic 

configuration where 

1. 's base language is the same as the usual language of arithmetic, 

2. 5^ 's Aq sub-class is defined by Item (b) in Example 3.2, 

3. f ^ 's base axiom system is [68] 's "Ax-3" system, 

4. 's deduction method is either a Herbrandized styled-method or a Resolution system that relies 
upon Skolemizatin in a similar manner. 

5. 's Godel encoding scheme may be any such natural method. 

This approach supports a stronger form of self-justification result than had appeared in [68]. This is 
because can be proven to be E-stable (by a generalization of [68] 's analysis techniques). Thus, 

Theorem 5.11 implies that Ax-3 has a well-defined self-justifying extension that can recognizes its own 
formalized Level(O^) consistency. (This self-justification result is stronger than [68] 's main theorem. The 
latter merely established that some extension of Ax-3 recognized the non-existence of a Herbrandized 
deduction of = 1 from itself.) 
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Each of Table I's rows ^ , ^** and ^~ are maximal (in that an alternate row 
improves upon one column's measurement only when it is weaker from the perspective 
of another column). Only is an exception to this rule: It is strictly weaker than 
^**. This appendix has discussed ^* because it makes Theorem D.4's proof simpler (and 
also because semantic tableaux is a frequent topic in the logic literature). 

Table I 



Name 


Deduction Method 


Type 
A 


Almost 
M 


Type 
M 


Axiom 

Format 


Self- Just 
Level 




Resolution and/or 
Herbrandized analogs 


Yes^s 


Yes 


No 


E-stablc 


Level (0^) 


r 


Semantic Tableaux 


Yes 


No 


No 


EA-stablc 


Level (1*) 




Tab-[/i* Deduction 34 


Yes 


No 


No 


EA-stablc 


Level (1*) 


r 


Hilbert Deduction 


No 


No 


No 


EA-stable 


Level ( oo~ ) 



The footnote , attached to Table Ts first row, explains why a caveat is attached 
to its first "Yes" entry. The theme of Table I is that self-justifying axiom systems have 
some nice redeeming features, although the Second Incompleteness Theorem clearly also 
imposes severe limits on their abilities. This point will be reinforced when Appendix E 
introduces a generalization of the Second Incompleteness Theorem, that shows Theorem 
6.12's translational reflection principle is close to being a maximal feasible result, and 
when Appendix F discusses the epistemological significance of self justification. 



^"^ ^** employs a stronger deduction method than ^* because it allows a modus ponens rule for 

and Sj sentences to be added to semantic tableaux dedxiction (see [64] for the precise definition of this 
"Tab— f/i " modification of the semantic tableaux deductive method). 



^^For the sake of simplicity, the Ax-3 system of [68] did not use either Equations (2) or (4)'s as 

axiom statements (since they were provable as theorems). All [68] 's results do, however, generalize when 
(2)'s statement about addition's totality is included as an axiom. Thus, it is appropriate to attach the 
designation of "Yes" with a caveat to the "Type-A" entry in Table Ts first row. (This row is called 
"Resolution and/or Herbrandized analogs" because it applies to essentially any deduction scheme that 
relies upon Skolemization as an alternative to [12] 's semantic tableaux existential quantifier elimination 
rule.) 
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Appendix E: A Clarification of Theorem 6.12's Significance 



It has been known since the time of Godel that most conventional arithmetic axiom 
systems will satisfy the following two invariants: 

1. They are physically unable to prove their own consistency 

2. They are Si complete. This means they can formally prove any Si arithmetic 
sentence that holds true in the Standard-M model, and they can likewise refute 
any 11^ sentence that is false. 

Let ^ denote any generic configuration of the form (L^,AQ,B^,d,G). This appendix 
will use the term ^—Conventional to describe any axiom system that satisfies analogs 
of the preceding conditions for generic configurations. Thus a is ^—Conventional iff it 
satisfies the following two criteria: 

a. The axiom system a will be unable to verify its own consistency under ^ 's 
deduction method of d . 

b. The axiom system a will be an extension of ^ 's base axiom of . Part-3 of 
Definition 3.4 will thus imply it is S^ complete. (Hence, a can formally prove any 
sf sentence that holds true in the Standard-M model, and it can likewise refute 
any 11^ sentence that is false.) 

This section will prove no analog of Equation (34) 's translational reflection principle 
is feasible for ^—Conventional axiom systems. Thus, Theorem 6.12 must be close to 
being a maximal result, since it cannot plausibly be further extended to hold under 
conventional axiom systems. 

Theorem E.l (A New Type of Version of the Second Incompleteness Theorem): 
There exists no ^—Conventional axiom system a that can prove the validity of (51) 's 
Translational Reflection Principle for any translation-mapping T. (In other words, there 
exists no algorithm T that maps 11^ sentences ^ onto alternate 11^ sentences , 
which are equivalent to ^ in the Standard-M model and where a can verify (51) 's 
reflection principle for every 11^ sentence \I'. ) 

Vp [ Prfad \^],P) ^ ] (51) 

Proof: It is easy to prove Theorem E.l via a proof-by-contradiction. Thus consider 
the possibility that Theorem E.l's translational mapping T did exist. One can then 
easily select a nf sentences * that is false in the Standard-M model. Then is also 
false under the Standard-M model (since * and '^^ are equivalent in this model). 

Hence Part-b of the definition of ^—Conventionality implies a must prove -> ^'■^ 
(on account of 's H^ format). 
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It is at this juncture that our proof-by-contradiction wih reach its end. This is 
because if a can prove (51) 's statement and also prove the sentence , then it 

certainly can combine these two facts to prove the non-existence of a proof of ^ . The 
latter contradicts Part-a of the definition of ^—Conventionality (because it shows a can 
verify its own consistency). □ 

Remark E.2. We remind the reader that Footnote 14 pointed out that T's transla- 
tional mapping would lose its main functionality, if it did not require to have a 11^ 
format, similar to ^. In essence, Theorem E.l is of interest because it shows that The- 
orem 6.12's evasion of the Second Incompleteness Theorem is close to being a maximal 
result. (It thus shows that (51) 's translational reflection principle does not generalize 
to conventional axiom systems.) This dichotomy may explain why self-justifying axiom 
systems, along with Theorem 6.12's particular invariant, are potentially useful results. 

Appendix F: Epistemological Perspective and Speculations 

It is desirable to include a short purely epistemological discussion within this mostly 
mathematical article so that the more subtle nature of our results cannot be miscon- 
strued. 

Part of the reason Self Justification can lend itself to easy misinterpretations is that 
the First Incompleteness Theorem demonstrates the impossibility of constructing an 
ideally optimal axiomatization of number theory. For any initial r.e. axiom system a 
and deduction method d, Godel thus noted it is easy to develop an extension of a 
that can prove strictly more theorems than a under d's deduction method. Moreover, 
a large number of generalizations of the Second Incompleteness Theorem, starting with 
its 1939 Hilbert-Bernays version [16], are known to be robust results. 

Such considerations naturally lead to questions about whether any r.e. axiom system 
can encompass the workings of the human mind. It may surprise some readers to learn 
that this author shares such skepticism. That is, we doubt any single ISOLATED self- 
justifying r.e. logic can fully approximate the complex workings of the human mind. 

In this short appendix, let us instead view cogitation as roughly a process won- 
dering though some universe U, comprised of both consistent and inconsistent axiom 
systems, with a trial-and-error evolutionary method focusing its attention over time in- 
creasingly onto the members of this universe U that are found to be consistent. It is 
straightforward^^ to define many universes U and evolutionary processes that fall into 

^^Let l}{a,d) the classic Godcl sentence that asserts: "There is no proof of this sentence from a's 
axiom system under d's deduction method." Godel [14] noted a + U{a,d) always proves more theorems 
than a. 

^^It is trivial from a theoretical perspective to design a learning heuristic that will utilize all consistent 
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this gendre. Our goal in this section will be to examine Section 5's "R-View" 9 and its 
RE-Class(0. 

Thus, 9 will denote an R-View that consists of an arbitrary r.e. set of Ilf sentences. 
Also, RE-Class(^) will again denote the set of all 9 which can be built under ^ 's 
language of L^. (Section 5 had allowed both valid and invalid R- Views 9 to appear 
in RE-Class(^) because no recursive decision procedure can identify all the Standard-M 
model's true Ii\ sentences.) 

The cpistcmological purpose of this notation was revealed in Section 6. For the cases 
where = or 1, Section 6 defined G|( ) to be the axiom system: 

gI{9) = ^ U 5^ U SelfCons'={ [ U 5« ] , d } (52) 

Also, Definition 6.2 indicated that the function G| (which maps 9 onto gI{9) ) would 
be called Consistency Preserving iff G|(^)is assured to be consistent whenever all 
the sentences in 9 arc true under the Standard-M model. Theorem 6.3 indicated, in 
this context, that G\ satisfies this property whenever ^ is EA-stable. Likewise, Gq 
is consistency preserving whenever ^ is one of A-stable, E-stable or 0-stable. 

These results indicate a trial-and-error experimental process can, indeed, walk in an 
unusually orderly manner through an universe of self-reflecting candidate formalisms, 
when RE-Class(^) denotes U 's universe and ^ satisfies any of the EA-stable, E-stable, 
A-stable or 0-stable conditions. This is because if 9 designates a set of Jl\ sentences 
holding true in the Standard-M model, then G|(^) will automatically satisfy both 
Parts (i) and (ii) of Section I's definition of Self Justification, according to Theorem 6.3. 

Such consistency preservation is surprising because it is simply inapplicable to the G| 
functions for most pairs (^, k). Theorem 6.3's first contribution is, thus, that it formalizes 
how 's mapping function can represent a type of approximation for instinctive faith, 
under certain well-defined circumstances. 

This notion of instinctive faith is, of course, less robust than a conventional proof. 
One obvious difficulty is that a 1-sentence proof, using an "/ am consistent" axiom, is 
less convincing than a full-length proof from first principles. Also, if the initial formalism 
9 contains a false Ilf sentence then + 9 and G|(0) will be both inconsistent. 



axiom systems from its available universe II eventually, and it will spend only an infinitesimal fraction 

of its effort on inconsistent systems as time runs to infinity. (This because there exists only a countable 
number of distinct r.e. sets belonging to the universe U. ) Also, this learning process can presumably be 
made to employ some type of smart souped-up AI heuristics to enhance its efiiciency, whose details will 
not concern us in this abbreviated 3-page appendix. What is central to the current discussion is that 
some type of formally non-recursive and presumably trial-and-error method must obviously be used by 
this learning process to find the consistent elements of W , on account of Godel's undecidability results. 
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Nevertheless for k equals or 1, if 6 is comprised of the true sentences in the 
Standard-M model, then Theorem 6.3 will assure that Gl{e) is a consistent system 
that has an ability to use its "/ am consistent" axiom sentence to formalize its own 
consistency. Moreover, the axiom system is helpful because Godel's famous 

centennial paper implicitly raised the following bedeviling issue: 

# How is it that Human Beings manage to muster the physical drive to 
think (and prove theorems) when the many generalizations of Godel's Second 
Incompleteness Theorem demonstrate conventional logics lack knowledge of 
their own consistency? 

While philosophical paradoxes and ironical dilemmas, similar to ^ , never yield per- 
fect answers, the preceding discussion is helpful because it explores a certain syllogism 
whereby a logic can formalize at least some fragmented operational appreciation of its 
own consistency. 

Moreover, Part-3 of Appendix D indicated that its four self-justifying configurations 
were close to being maximal results that cannot be much improved, on account of various 
barriers imposed by the Second Incompleteness Theorem. Thus, these particular positive 
results, combined with Theorems 5.9 6.3, 6.6, 6.10, 6.12, D.4, E.l, G.2, G.3 and Remarks 
6.4 and 6.16, come close to formalizing the maximal variants of instinctive faith that a 
first-order logic can bolster. 

The theme of the last two paragraphs is thus that our approximation of "instinctive 
faith" may be imperfect, but it is still a useful partial reply to # 's puzzling dilemma 
in a context where unambiguous full resolutions to # are not permitted by the Second 
Incompleteness Theorem. Furthermore, Equation (34) 's translational reflection principle, 
together with Theorem 6.12 and the Remarks 6.13 and 6.14, illustrate how the notion 
of an instinctive faith about the usefulness of Hf theorems can be almost physically 
hard-wired into self-justifying formalisms. 

A Yet Further Facet of this Unusual Epistemological Interpretation: Let 

the term Epistemological Bundle Theory refer to the underlying theory, advanced in 
this appendix, which speculates about a Thinking Agent walking through RE-Class(^)'s 
bundled universe of valid and invalid collections of sentences and then applying some 
heuristic to attempt to identify those 9 GRE-Class(^) whose sentences are true under 
the Standard-M model. 

Such a theory has a second virtue, aside from addressing ^ 's paradoxical question 
about the nature of "instinctive faith". It also clarifies the meaning of our main theorems 
and the related E-stability, A-stability, EA-stability and RE-Class(^) constructs. 
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This is because the Items * and ** from the definitions of A-stabihty and E-stability 
in Section 5 formalize how a thinking agent T can view short proofs from a technically 
inconsistent axiom system of U 6 as containing pragmatically useful information 
under the assumption that the lengths of T 's proofs are shorter than the errors in 
9 's styled-statements. The pleasing aspect about this observation, illustrated by 
Remark 5.2, is that those same invariants, * and ** , which tempt a thinking agent T 
to engage in a trial-and-error walk through RE-Class(^)'s bundled universe, also make 
viable Theorem 5.9's self-justifying formalisms. 

Thus aside from addressing ^ 's dilemma about the nature of instinctive faith, the 
meta-formalism in this appendix is useful in explaining the motivation behind the elab- 
orate network of theorems, proofs and definitions that were introduced in this paper. 
In summary, EA-stable logics are thus interesting both in their own right (as a vehicle 
enabling a Thinking Being to partially tolerate its own errors), and because they are 
useful in explaining how a Thinking Being can possess a type of instinctive faith in its 
own consistency (via the reflection principles of Theorem 6.12 and of Remarks 6.13 and 
6.14). 

Appendix G: Improvements upon Theorems 6.6 and 6.10 

Let us recall that Remark 6.11 indicated that there was a subtle trade-off between 
Theorems 6.6 and 6.10, where neither result was strictly better than the other. This 
section will introduce two hybrid methodologies, using Definition G.l's formalism, that 
improve upon Theorem 6.10 while retaining a large part of Theorem 6.6's nice features. 

Definition G.l Let ^ denote the generic configuration, whose base axiom system 
is again denoted as -B^ , $ denote any 11^ sentence that is true in the Standard-M 
model and j denote an index that represents some predicate Test| lying in Definition 
6.8's TestList^ sequence. Then a Ilf sentences ^ will be said to be a Braced^ ($ , j ) 
expression when + $ can prove: 

{ y X Test|( [ ^' ] , X ) } — > * (53) 

Theorem G.2 Let ^ again denote an arbitrary generic configuration {L^, Aq,B^, d, G), 
and let {B,T)) again denote any second axiom system and deduction method whose nf 
theorems are true under the Standard-M model. Then for any integer j and for any nf 
sentence $ that is true in the Standard-M model, the following invariants do hold: 

i If ^ is EA-stable then there will exist a self-justifying j5j D B^ that can recognize its 
Level{l^) consistency, contains only a. finite number of additional axioms beyond 
those appearing in B^, and which can prove all of {B,V)'s Ilf theorems that are 
BraceS{^,j) expressions. 
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ii Likewise, if ^ is E-stable, A-stable or 0-stable then a self-justifying [3j D will exist 
with the same properties except that it recognizes its own Level{0^) consistency. 

Proof. To justify Theorem G.2, we must first define the axiom system f5j , whose 
existence is claimed by Items (i) and (ii) . It will be defined to consist of the union of the 
initial base axiom system with the following three added axiom-sentences. 

1 The sentence $ used by Definition G.l's Braced^($,j) formula. 

2 A GlobSimg (C,j) sentence whose indexing integer j is defined by Definition G.l. 

This global simulation sentence is thus the statement: 

Vt Vx { [ Pif^{t,q) A Check«(t) ] — > Test|(t,x) } (54) 

3 A nf sentence of the form SelfCons''{ [6 U B^ ] ,d} where: 

a is an R-view consisting of the two 11^ sentences defined by Items 1 and 2. 

b B^ is ^ 's base axiom system, and 

c k equals respectively 1 and under formalisms (i) and (ii). 

Thus, the system Pj uses identical definitions under formalisms (i) and (ii), except that 
its third sentence will use a different value for k . Our proof of Theorem G.2 will require 
first confirming the following fact: 

Claim * The axiom system Pj (which consists of the union of B^ with the sentences 
1-3) will have a capacity to prove every Braced^($,j) sentence * that is a Ilf 
theorem of {B,T>). 

The proof of Claim * is quite simple. It will rest on the following three observations: 

a For each 11^ sentence ^ , the system /3j must certainly have a capacity to prove 

(55) 's sentence (which states that ^ 's Godcl number formally encodes a 11^ state- 
ment). This is because (55) is true in the Standard-M model and because Part 3 
of Definition 3.4 indicated that the B^ sub-component of (3j has a capacity to 
prove every Aq sentence that is true. 

Check«( \^^) (55) 

b Since Claim * specifies \I/ is a theorem of {B,T?), there must certainly exist some 
integer N that is the Godel number of its proof from {B,V). This implies that 

(56) must be a true Aq sentence under the Standard-M model. As was the case 
with Equation (55), this implies that it must be provable from B^ (because it is 
a valid Aq sentence). 

Prf^(r*l,iV) (56) 
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c It is apparent that Equations (54), (55) and (56) imply the vahdity of (57). Moreover, 
Part 4 of Definition 3.4 indicated that the generic configuration 's deduction 
method does satisfy Godcl's Completeness Theorem. This fact assures that f3j 
must be able to prove (57) because it contains (54) as an axiom and (55) and (56) 
as derived theorems 

y X Test^( r*l , a; ) (57) 

Claim * is a consequence of Observations a-c. This is because $ is one of j3j 's defined 
axioms, and Definition G.l indicated + ^ was capable of proving (53)'s statement 
for every Braced^ ($,j') sentence * . These facts corroborate Claim * because they imply 
that pj must be able to verify Claim * 's sentence (because Pj can verify statements 
(53) and (57)). 

The remainder of Theorem G.2's proof is analogous to Theorem 6.10's proof. This is 
because the prior paragraph established that /3j can prove every Braced^ ($,j) theorem 
of {B,V) (as was required by Claims i and ii ). The only remaining task is to show 
that Pj is a self-justifying formalism that can recognize its Level(l^) and Level(O^) 
consistencies, as specified by Claims i and ii. This part of Theorem G.2's verification 
is identical to the methods used to prove Theorems 6.3 and 6.10. It will thus not be 
repeated here. □ 

The last part of this appendix will require the following additional notation to for- 
malize the main intended application of Theorem G.2's formalism. 

1. Count(^') will denote the number of quantifiers appearing in the sentence ^ (in- 
cluding both its bounded and unbounded quantifiers). 

2. Size^(c) will denote the set of Ilf sentences ^ where Count(^') < c. 

Our next theorem will be a specialized variant of Theorem G.2, using the Size^(c) con- 
struct. It will explain the intended application of this formalism: 

Theorem G.3. Let ^ denote any one of Appendix D's four sample generic 
configurations of ^* , ^** , or . Then for any c> , Theorem G.2's axiom 
systems of Pj can be arranged so that they can prove all of {B, T>) 's Size^{c) Ii\ theorems 
while simultaneously also recognizing their: 

1. Level(l) consistency for the cases when ^ is one of ^* , ^** or ^~ . 

2. Level(O) consistency when ^ is . 

Every deduction method d, satisfying Godel's Completeness Theorem, will be automatically able 

to prove a theorem Z when it contains X, y and {X AY) — > Z as theorems, irregardless of whether or 
not it contains an explicit built-in modus ponens rule. Thus d can prove (57) because of its knowledge 
about (54)-(56)'s vaUdity. 
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Proof Sketch: The intuition behind Theorem G.3's proof is quite easy to summarize. 
For arbitrary c > and any of Appendix D's eonfigurations of ^* , ^** , ^~ and , 
it is routine to construct an ordered pair j) where every 11^ sentence of Size^(c) is 
a Braced^(<I>, j) expression. Theorem G.3's first claim is, thus, a consequence of Part (i) 
of Theorem G.2 and the fact that each of ^* , ^** and ^~ are EA-stable. Likewise, 
Theorem G.3's second claim follows from Part (ii) of Theorem G.2 and the fact that 
is E-stable, □ 

Remark G.4. The Theorems G.2 and G.3 are of interest because the set of 11^ 
sentences of Size^(c) is a natural class to examine. It is, thus, tempting to consider a 
system that recognizes its own formal consistency, uses only a finite number of axiom 
sentences beyond those in , and which can prove all of (H, P)'s nf theorems of 
Size^(c). Such a system replies to Remark 6.11's challenge by hybridizing the properties 
of Theorems 6.6 and 6.10, in a seemingly pragmatic manner. 
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